feat: user auth, API keys, Stripe billing, and dashboard scoping

- NextAuth v5 credentials auth with registration/login pages
- API key CRUD (create, list, revoke) with secure hashing
- Stripe checkout, webhooks, and customer portal integration
- Rate limiting per subscription tier
- All dashboard API endpoints scoped to authenticated user
- Prisma schema: User, Account, Session, ApiKey, plus Stripe fields
- Auth middleware protecting dashboard and API routes

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-Claude)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

apps/web/src/app/api/settings/purge/route.ts

@@ -1,13 +1,22 @@
 import { NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
+import { auth } from "@/auth";
 
 export async function POST() {
   try {
+    const session = await auth();
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const userId = session.user.id;
+    const traceFilter = { trace: { userId } };
+
     await prisma.$transaction([
-      prisma.event.deleteMany(),
-      prisma.decisionPoint.deleteMany(),
-      prisma.span.deleteMany(),
-      prisma.trace.deleteMany(),
+      prisma.event.deleteMany({ where: traceFilter }),
+      prisma.decisionPoint.deleteMany({ where: traceFilter }),
+      prisma.span.deleteMany({ where: traceFilter }),
+      prisma.trace.deleteMany({ where: { userId } }),
     ]);
 
     return NextResponse.json({ success: true }, { status: 200 });