Move API key notifications to relational tables

[MaxEriksson2000]

Summary

Moves API key notification user state out of JSON blobs and into relational tables, while simplifying reminder semantics from arrays to a single day threshold.

What changed

• add api_key_notification_preferences and api_key_notification_subscriptions tables with an Alembic migration that moves existing notification state out of settings.chatbot_widget.api_key_notifications
• switch backend notification models and endpoints to a scalar days_before_expiry / default_days_before_expiry contract and route all preference/subscription reads and writes through a dedicated repository
• keep tenant notification policy in api_key_policy.notification_policy, but normalize legacy array payloads to a single scalar value
• update frontend notification preferences and admin policy UI to use a single reminder day value end to end
• extend the admin API key edit dialog so expires_at and resource_permissions can be updated without revoke/recreate
• restrict fine-grained resource permissions in the admin edit UI to sk_ keys, matching backend policy enforcement
• harden the migration to skip corrupt legacy subscription IDs instead of failing the whole migration
• prevent admin policy updates from surfacing an uncontrolled server error when max_days_before_expiry is lowered below the previous default

Why

The notification feature had started to accumulate hidden complexity in JSON blobs, plus model/UI drift around reminder arrays vs. single-value semantics. This change makes the data model explicit, easier to migrate, and easier to extend later if delivery channels are added.

Validation

• bun run test:unit -- src/lib/features/api-keys/notificationPreferences.test.ts
• bun run check
• uv run --directory backend ruff check src/intric/authentication/auth_models.py src/intric/authentication/api_key_router.py src/intric/authentication/api_key_notification_auto_follow.py src/intric/authentication/api_key_notification_repo.py src/intric/admin/admin_router.py tests/unit/test_api_key_notification_auto_follow.py tests/unit/test_api_key_notification_models.py tests/integration/test_api_key_auto_follow_publish.py
• uv run --directory backend pyright src/intric/authentication/auth_models.py
• uv run --directory backend alembic heads

Notes

Full backend pytest was not runnable in this environment because the local test setup is missing libmagic.