added multi user support, move api key to database

backend/app/routers/logs.py

@@ -0,0 +1,38 @@
+"""Read-only activity log. Admin-only: shows every state-changing action and
+auth event, filterable by acting user."""
+
+from fastapi import APIRouter, Depends
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session as DbSession
+
+from ..auth import require_admin
+from ..database import get_db
+from ..models import Admin, LogEntry
+from ..pagination import Page, PageParams
+from ..schemas import LogOut
+
+router = APIRouter(prefix="/logs", tags=["logs"])
+
+
+@router.get("", response_model=Page[LogOut])
+def list_logs(
+    page: PageParams = Depends(),
+    username: str | None = None,
+    action: str | None = None,
+    _: Admin = Depends(require_admin),
+    db: DbSession = Depends(get_db),
+):
+    stmt = select(LogEntry)
+    count_stmt = select(func.count()).select_from(LogEntry)
+    if username:
+        stmt = stmt.where(LogEntry.username == username)
+        count_stmt = count_stmt.where(LogEntry.username == username)
+    if action:
+        stmt = stmt.where(LogEntry.action == action)
+        count_stmt = count_stmt.where(LogEntry.action == action)
+
+    total = int(db.execute(count_stmt).scalar_one())
+    rows = db.execute(
+        stmt.order_by(LogEntry.id.desc()).limit(page.limit).offset(page.offset)
+    ).scalars().all()
+    return Page(total=total, limit=page.limit, offset=page.offset, items=rows)