Release v0.334.0 — scoped API keys + health/logs + OpenAPI docs · budgets-au/budgets

Container

ghcr.io/budgets-au/budgets:0.334.0
ghcr.io/budgets-au/budgets:latest

Per-key API scopes. New `scope` field on API keys — pick when minting:
- Full access (`full`) — default. Access to every route the key's role permits.
- Ops (`ops`) — restricted to `/api/health`, `/api/logs`, `/api/version-check`, `/api/github-stats`, `/api/openapi.json`. Perfect for an assistant / home-automation integration that only needs infrastructure telemetry — payee / amount / balance endpoints refuse with `403 {"error":"Scope does not permit this endpoint"}`.
`GET /api/health` — version, uptime, `dbUnlocked`, active profile, memory, node version.
`GET /api/logs` — new in-process ring buffer (max 1000 lines) capturing every `console.*` call. Query `?limit=N&level=warn,error`. Documented privacy caveat: don't console.log sensitive strings.
API docs at `/docs/api` — Scalar-rendered interactive reference generated from Zod schemas via `@asteasolutions/zod-to-openapi`. Spec served at `GET /api/openapi.json` (in the ops allowlist so scoped consumers can discover their own endpoints). v1 documents ~15 endpoints (ops + admin control-plane + API-key CRUD + core financial reads); rest still work, get added over time.

Migration `0019_api_keys_scope` — adds `api_keys.scope TEXT NOT NULL DEFAULT 'full'`. Existing rows inherit `full` — behavioural no-op for old keys.

tsc clean, `pnpm build` clean, 751/761 unit pass (+10 vs 0.333), pages-smoke + proxy-auth 16/16 green.

Pull `ghcr.io/budgets-au/budgets:0.334.0`. Migration 0019 runs on first unlock. Existing keys keep working (`full` scope preserved).