feat(auth): record throttled lastUsedAt on authentication and expose in key listing

.env.example

@@ -157,6 +157,10 @@ ADMIN_TOKEN=super-secret-admin-token
 # Set to "false" to disable API-key auth entirely (e.g. local dev). Any other
 # value (or unset) leaves auth enabled, so every non-public route needs a key.
 REQUIRE_API_KEY=true
+# Minimum throttle interval (in seconds) between database writes updating an API key's `lastUsedAt`.
+# Prevents high-frequency authenticated traffic from turning read-only authentication
+# into a database write on every call (default: 60).
+KEY_LAST_USED_THROTTLE_SECONDS=60
 # Fallback rate limit (requests per minute per IP) for unauthenticated or public requests (default: 100)
 RATE_LIMIT_IP_MAX=100
 # Requests this single instance will accept per minute in total, across every

prisma/schema.prisma

@@ -265,6 +265,7 @@ model ApiKey {
   revokedAt        DateTime? @map("revoked_at")
   expiresAt        DateTime? @map("expires_at")
   createdAt        DateTime  @default(now()) @map("created_at")
+  lastUsedAt       DateTime? @map("last_used_at")
   monthlyQuotaCents Int?     @default(10000) @map("monthly_quota_cents")
   dailyQuotaCents  Int?      @default(500) @map("daily_quota_cents")
   overagePolicy    String    @default("block") @map("overage_policy")