Add TOTP-gated provider API key reveal

Allow super administrators to inspect effective provider credentials only after audited, rate-limited step-up verification.

admin-web/src/api/client.ts

@@ -24,6 +24,8 @@ import type {
   CreateOfficialSkillRequest,
   OfficialSkill,
   OfficialSkillCatalog,
+  RevealProviderApiKeyRequest,
+  RevealProviderApiKeyResponse,
   ReferralsQuery,
   ReferralOverview,
   SessionResponse,
@@ -94,6 +96,7 @@ function safeMessage(status: number, code?: string): string {
     HINT_FEED_SETTINGS_INVALID: "Hint 自动生成配置不符合要求",
     HINT_FEED_GENERATION_FAILED: "Hint 提示包生成失败，旧版本仍保持可用",
     PROVIDER_API_KEY_INVALID: "API Key 不符合要求",
+    PROVIDER_API_KEY_NOT_CONFIGURED: "该 Provider 尚未配置可读取的 API Key",
     PROVIDER_NOT_FOUND: "不支持该 Provider",
     RATE_LIMITED: "操作过于频繁，请稍后再试",
   };
@@ -293,6 +296,18 @@ export const adminApi = {
 
   providers: () => request<ManagedProviderOverview>("/providers"),
 
+  revealProviderApiKey: (
+    providerId: ManagedProviderId,
+    payload: RevealProviderApiKeyRequest,
+  ) =>
+    request<RevealProviderApiKeyResponse>(
+      `/providers/${encodeURIComponent(providerId)}/api-key/reveal`,
+      {
+        method: "POST",
+        body: JSON.stringify(payload),
+      },
+    ),
+
   updateProviderApiKey: (
     providerId: ManagedProviderId,
     payload: UpdateProviderApiKeyRequest,

admin-web/src/api/types.ts

@@ -20,7 +20,8 @@ export type AdminAuditAction =
   | "CONTENT_HINT_PACK_SAVED"
   | "CONTENT_HINT_FEED_SETTINGS_UPDATED"
   | "CONTENT_HINT_FEED_GENERATED"
-  | "PROVIDER_API_KEY_UPDATED";
+  | "PROVIDER_API_KEY_UPDATED"
+  | "PROVIDER_API_KEY_REVEALED";
 
 export interface SkillLocalization {
   name: string;
@@ -141,6 +142,14 @@ export interface UpdateProviderApiKeyRequest {
   apiKey: string;
 }
 
+export interface RevealProviderApiKeyRequest {
+  totpCode: string;
+}
+
+export interface RevealProviderApiKeyResponse {
+  apiKey: string;
+}
+
 export interface CursorPageQuery {
   cursor?: string;
   limit?: number;