Add API key management page for signed-in users

[krowvin]

Adds a signed-in API Keys page and guide for creating, viewing, rotating, and revoking keys without Swagger. Keys belong to the current user and inherit that user's permissions. Secrets are shown once and kept out of browser storage and query caches. Rotation creates a replacement before offering to revoke the original.

• Merge current develop, including /auth/keys cleanup #1935, while retaining the Swagger links to the key-management guide.

• Add dismissible toasts for create, copy, refresh, revoke, rotation, expired keys, and request failures. Toasts remain accessible inside dialogs; errors also stay beside the form. Success feedback expires after eight seconds, while errors and warnings remain dismissible.

• Translate the new endpoint validation responses into useful name/date/payload guidance; handle duplicate-name 409 responses and empty 204 revocation responses. Invalid local dates are rejected before submission.

• Keep replacement names within 64 characters and clear stale key details after refresh or a 404. Failed creation never revokes the original; failed or cancelled revocation preserves both keys.

• Show a permission warning page on denied key access, listing CWMS Users and a signed-in cac_auth session, highlighting recognized missing roles, and directing users to their CWMS Admin. Management controls are hidden until access is restored.

• Emphasize in bold that keys are shown only at creation and cannot be retrieved again, in the create/save dialogs and help/rotation instructions. Companion API response and Swagger clarification: Omit API key secrets from GET responses and clarify one-time retrieval #1941.

Validation:

• 14 adapter/auth unit tests, 10 Chromium browser tests, Storybook test, lint, formatting, and production build passed. The API-key tests now run in the web GUI CI workflow.

• Real local CDA/Oracle/Keycloak checks against the /auth/keys cleanup #1935 backend verified duplicate-name conflict feedback, retry in the same dialog, creation, expiration metadata refresh, one-time-secret closing, and 204 revocation feedback. Temporary keys were removed; secrets were excluded from logs and screenshots.

• Previous full Java 11 gradlew build passed, including 786 service unit tests and generated OpenAPI/TypeScript checks.

Screenshots

These screenshots show the earlier layout before the latest wording and styling refinements. They are embedded from an earlier commit; screenshot files are excluded from the PR changes.

The IP address shown in the curl example is generated dynamically from the current host and changes with the deployment. This screenshot was taken on a local development host.

Mobile views

One-time-key guidance validation: 14 unit tests, 10 Chromium browser tests, lint, formatting, and production build passed.

AI tools used

[krowvin]

Merged develop, including the /auth/keys cleanup in #1935, into this PR and updated the UI to use the improved endpoint responses.

• Added dismissible toasts for creation, copying, refresh, revocation, rotation, expired keys, and request failures, including inside active dialogs.
• Added actionable feedback for duplicate-name 409 responses and name/date/payload validation errors. Form values remain available for retry, and empty 204 revocation responses are handled successfully.
• Kept replacement names within 64 characters and cleared stale key details after refresh or a 404. Failed creation leaves the original key intact; cancelled or failed revocation preserves both keys.
• Added regression coverage to the web GUI CI workflow.

Local validation passed: full Java 11 build (786 service unit tests), 13 adapter/auth unit tests, 6 Chromium browser tests, Storybook, lint, formatting, and production build. Real local CDA/Oracle/Keycloak testing against the #1935 backend verified duplicate conflict feedback, successful retry, creation, refresh, one-time-secret closing, and 204 revocation feedback. Temporary keys were removed.

Commits: 592f77f (merge) and 4b80047 (UI feedback and validation recovery).

[Theresa5683]

thanks for doing this, looks good!