feat(fc3b): extension_api_key endpoints + create_app bootstraps credential key

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_api_extension_api_key.py

@@ -0,0 +1,53 @@
+import pytest
+from sqlalchemy import select
+
+from backend.app import create_app
+from backend.app.models import AppSetting
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture
+async def app():
+    return create_app()
+
+
+@pytest.fixture
+async def client(app):
+    async with app.test_client() as c:
+        yield c
+
+
+@pytest.mark.asyncio
+async def test_get_seeds_a_value(client, db):
+    # First call seeds the row (idempotent on repeat calls).
+    resp = await client.get("/api/settings/extension_api_key")
+    assert resp.status_code == 200
+    body = await resp.get_json()
+    assert isinstance(body["key"], str) and len(body["key"]) >= 16
+
+    row = (await db.execute(
+        select(AppSetting.value).where(AppSetting.key == "extension_api_key")
+    )).scalar_one()
+    assert row == body["key"]
+
+
+@pytest.mark.asyncio
+async def test_get_is_idempotent(client):
+    a = (await (await client.get("/api/settings/extension_api_key")).get_json())["key"]
+    b = (await (await client.get("/api/settings/extension_api_key")).get_json())["key"]
+    assert a == b
+
+
+@pytest.mark.asyncio
+async def test_rotate_changes_the_value(client, db):
+    before = (await (await client.get("/api/settings/extension_api_key")).get_json())["key"]
+    rotated = await client.post("/api/settings/extension_api_key/rotate")
+    assert rotated.status_code == 200
+    after = (await rotated.get_json())["key"]
+    assert after != before
+
+    row = (await db.execute(
+        select(AppSetting.value).where(AppSetting.key == "extension_api_key")
+    )).scalar_one()
+    assert row == after