feat(api): create users via referring integrations

[mogery]

Summary by cubic

Adds a new admin endpoint to create users via referring integrations, issue API keys, and apply integration-specific coupons. This enables partners to onboard users programmatically with a simple API.

• New Features
  • POST /admin/create-user: accepts email and authenticates via Bearer token (SHA-256 matched against user_referring_integration.key).
  • If the user exists under a different referrer, reuse or create a team for the current referrer and return its API key.
  • If new, create the user with referrer metadata, get the team’s API key, and return it.
  • Applies integration-defined coupons (credits, code, optional expiry in ms offset, rate limit/concurrency overrides).
  • Response: { apiKey, alreadyExisted }. Errors return clear 4xx/5xx messages.

^{Written for commit a3e140e. Summary will update automatically on new commits.}

[cubic-dev-ai]

No issues found across 2 files

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (all 1 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/api/src/controllers/v0/admin/create-user.ts">

<violation number="1" location="apps/api/src/controllers/v0/admin/create-user.ts:69">
P2: Validate that a Bearer token value is present before hashing it; otherwise requests with an empty token crash the controller and return 500 instead of 401.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

2 issues found across 2 files

Prompt for AI agents (all 2 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/api/src/controllers/v0/admin/create-user.ts">

<violation number="1" location="apps/api/src/controllers/v0/admin/create-user.ts:50">
P2: Malformed Bearer headers (`Authorization: Bearer` with no token) crash the handler and return 500 instead of a 401 because `token` is hashed without being validated.</violation>

<violation number="2" location="apps/api/src/controllers/v0/admin/create-user.ts:170">
P1: New teams created for preexisting users are never added to `user_teams`, so the user isn’t associated with the team and subsequent requests keep creating duplicate teams/coupons.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[mogery]

@cubic-dev-ai please re-review

[cubic-dev-ai]

@cubic-dev-ai please re-review

@mogery I've started the AI code review. It'll take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (all 1 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/api/src/controllers/v0/admin/create-user.ts">

<violation number="1" location="apps/api/src/controllers/v0/admin/create-user.ts:96">
P2: `alreadyExisted` stays false when an existing user needs a new team for this referrer, causing an incorrect API response. Set the flag as soon as a preexisting user is detected.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}