-- staff API keys (automation / AI ticket assistant): the key acts as its admin, with the admin's permissions
CREATE TABLE api_keys (
  id INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
  admin_id INT UNSIGNED NOT NULL,
  name VARCHAR(100) NOT NULL,
  token_hash CHAR(64) NOT NULL,
  prefix CHAR(8) NOT NULL,
  ip_allow VARCHAR(1000) NOT NULL DEFAULT '' COMMENT 'IPs / CIDR, empty = any',
  last_used_at DATETIME NULL,
  last_ip VARCHAR(64) NOT NULL DEFAULT '',
  revoked TINYINT(1) NOT NULL DEFAULT 0,
  created_at DATETIME NOT NULL,
  UNIQUE KEY token (token_hash),
  KEY admin (admin_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;