feat: complete commercial control plane, billing, auth, and model catalog

- add PostgreSQL control-plane persistence with Redis-degraded hot reload
- implement prepaid balance, usage ledger, Stripe top-up and reconciliation
- add registration, email verification, password reset, invitations and RBAC
- support TOTP, Passkey MFA, device sessions, quotas and rate limits
- add tenant billing profiles, audit logs and operational readiness checks
- build authenticated admin console, Quickstart, Playground and usage analytics
- add public model catalog with pricing, filtering and cost estimation
- support OpenAI Responses providers and provider health failover
- validate real upstream usage reporting and balance settlement

1 files changed, 31 insertions, 0 deletions

diff --git a/internal/auth/static_test.go b/internal/auth/static_test.go
index cf54ba6..a037ce1 100644
--- a/internal/auth/static_test.go
+++ b/internal/auth/static_test.go
@@ -4,6 +4,7 @@ import (
 	"crypto/sha256"
 	"net/http"
 	"testing"
+	"time"
 
 	"aigw/internal/domain"
 )
@@ -74,3 +75,33 @@ func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestStaticAuthenticatorLoadsRestrictionsAndRejectsExpiredKey(t *testing.T) {
+	future := time.Now().Add(time.Hour).UTC().Format(time.RFC3339Nano)
+	authenticator, err := NewStatic(`[{"key":"sk-limited","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","allowed_models":["model/allowed"],"monthly_spend_micros":1250000,"expires_at":"`+future+`"}]`, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
+	request.Header.Set("Authorization", "Bearer sk-limited")
+	principal, err := authenticator.Authenticate(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if principal.MonthlySpendMicros != 1_250_000 {
+		t.Fatalf("monthly spend limit = %d", principal.MonthlySpendMicros)
+	}
+	if _, ok := principal.AllowedModels["model/allowed"]; !ok {
+		t.Fatalf("allowed model was not loaded: %+v", principal.AllowedModels)
+	}
+
+	past := time.Now().Add(-time.Minute)
+	hash := sha256.Sum256([]byte("sk-expired"))
+	authenticator.ReplaceHashed([]HashedKeyRecord{{Hash: hash, Principal: domain.Principal{
+		KeyID: "expired", TenantID: "tenant-1", ProjectID: "project-1", ExpiresAt: &past,
+	}}})
+	request.Header.Set("Authorization", "Bearer sk-expired")
+	if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
+		t.Fatalf("expired key error = %v, want ErrUnauthorized", err)
+	}
+}