Foundation: config, schema/migrations, auth, stable IDs, metadata probing

internal/auth/apikey.go

@@ -0,0 +1,14 @@
+package auth
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+)
+
+// HashAPIKey returns a stable, non-reversible fingerprint of a raw API
+// key for storage and lookup (API keys are high-entropy random tokens,
+// not user-chosen passwords, so a plain fast hash is sufficient here).
+func HashAPIKey(raw string) string {
+	sum := sha256.Sum256([]byte(raw))
+	return hex.EncodeToString(sum[:])
+}