Add TOTP-gated provider API key reveal

Allow super administrators to inspect effective provider credentials only after audited, rate-limited step-up verification.

admin-web/src/test/client.test.ts

@@ -302,4 +302,28 @@ describe("adminApi", () => {
     expect((request.headers as Headers).get("X-CSRF-Token")).toBe("csrf-provider");
     expect(request.body).toBe(JSON.stringify({ apiKey: "new-provider-key" }));
   });
+
+  it("Provider API Key 查看请求携带 CSRF 且只提交动态验证码", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ apiKey: "current-provider-key" }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+    setCsrfToken("csrf-reveal");
+
+    const result = await adminApi.revealProviderApiKey("volcengine", {
+      totpCode: "123456",
+    });
+
+    expect(fetchMock.mock.calls[0]?.[0]).toBe(
+      "/v1/admin/providers/volcengine/api-key/reveal",
+    );
+    const request = fetchMock.mock.calls[0]?.[1] as RequestInit;
+    expect(request.method).toBe("POST");
+    expect((request.headers as Headers).get("X-CSRF-Token")).toBe("csrf-reveal");
+    expect(request.body).toBe(JSON.stringify({ totpCode: "123456" }));
+    expect(result.apiKey).toBe("current-provider-key");
+  });
 });