Add runtime provider controls and searchable AI routing

Manage provider keys at runtime, route current-information questions through server-side search with safe fallback, and scope OOBE usage claims to grants.

src/test/kotlin/com/osglab/account/config/DeploymentConsistencyTest.kt

@@ -238,6 +238,20 @@ class DeploymentConsistencyTest : FunSpec({
         keyboardSchema shouldNotContain "hostApplication"
     }
 
+    test("anonymous OOBE feature claims are scoped to each guided session") {
+        val migration = root.read(
+            "src/main/resources/db/migration/V27__scope_oobe_claims_to_grant.sql",
+        )
+        val openApi = root.read("docs/openapi.yaml")
+
+        migration shouldContain "PRIMARY KEY (grant_id, feature)"
+        migration shouldContain
+            "FOREIGN KEY (grant_id) REFERENCES oobe_gateway_grants (id) ON DELETE CASCADE"
+        migration shouldNotContain "PRIMARY KEY (subject_id, feature)"
+        openApi shouldContain "Each feature can"
+        openApi shouldContain "succeed once within this short-lived grant"
+    }
+
     test("production Compose reuses private MySQL and hardens the application container") {
         val compose = root.read("compose.yaml")
 
@@ -404,6 +418,8 @@ private val EXPECTED_PUBLIC_PATHS = setOf(
     "/v1/admin/auth/session",
     "/v1/admin/auth/login",
     "/v1/admin/auth/logout",
+    "/v1/admin/providers",
+    "/v1/admin/providers/{providerId}/api-key",
     "/v1/admin/overview",
     "/v1/admin/referrals",
     "/v1/admin/analytics",