feat(auth): add API-key authentication and tenant resolution

tests/unit/application/auth/test_keys.py

@@ -0,0 +1,38 @@
+import pytest
+
+from src.application.auth.keys import generate_api_key, hash_secret, parse_api_key, verify_secret
+
+pytestmark = pytest.mark.unit
+
+
+def test_generate_api_key_round_trips_through_parse() -> None:
+    key_prefix, secret, full_key = generate_api_key()
+
+    parsed = parse_api_key(full_key)
+
+    assert parsed == (key_prefix, secret)
+
+
+def test_generate_api_key_produces_unique_secrets() -> None:
+    _, secret_a, _ = generate_api_key()
+    _, secret_b, _ = generate_api_key()
+
+    assert secret_a != secret_b
+
+
+@pytest.mark.parametrize(
+    "malformed",
+    ["", "sk_onlyprefix", "wrongscheme_prefix_secret", "sk__secret", "sk_prefix_"],
+)
+def test_parse_api_key_rejects_malformed_input(malformed: str) -> None:
+    assert parse_api_key(malformed) is None
+
+
+def test_verify_secret_accepts_matching_secret() -> None:
+    _, secret, _ = generate_api_key()
+
+    assert verify_secret(secret, hash_secret(secret))
+
+
+def test_verify_secret_rejects_wrong_secret() -> None:
+    assert not verify_secret("wrong-secret", hash_secret("correct-secret"))