- Extract the profile API-key UI into a shared ApiKeysManager component
(modal create form, full/readonly toggle, and detailed permission-scope
picker). Profile and the service-account detail page both use it, so the
two interfaces stay consistent and the code isn't duplicated.
- Add GET /users/:id/permission-options (service accounts), mirroring
GET /me/permissions, so the scope picker shows exactly the pairs the
account holds; the same query caps the key server-side.
- Service and system accounts never receive notifications: recipient
resolution now targets account_type='user' across explicit, org-wide,
and org-scoped paths (also fixes a stale 'human' literal that matched
nothing).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
marc
3bdb396ba2