Service accounts and API keys

[GregorShear]

Summary

• Service Accounts — new admin section replacing the CLI-API tab. Create accounts with scoped capabilities on catalog prefixes, manage grants, and issue/revoke API keys from a detail view. Key secrets are shown once at creation and can't be retrieved again.
• flowctl access token — new /flowctl/accessToken page with a copy-to-clipboard button for completing flowctl login; the token is never rendered on screen. /admin/api redirects here.
• Personal Tokens — refresh token management moved to /settings/personalTokens, linked from the user menu.
• Supporting GraphQL queries/mutations and regenerated GQL types; new theme.radius border-radius scale.

Test plan

• Create a service account with each capability level and verify it appears in the list
• Create an API key, confirm the secret is shown once, copy it, close the dialog, and verify it can't be retrieved again
• Revoke an API key and confirm it disappears
• Disable a service account and verify the status updates and API key creation is blocked; re-enable and verify keys can be created again
• Add and remove grants from the detail view
• Visit /admin/api and confirm it redirects to /flowctl/accessToken; verify the copy button works and the token is not visible on screen
• Open Personal Tokens from the user menu and verify refresh tokens can be created and revoked

[github-actions]

✅ Code Health

Removes $\textcolor{green}{1}$ dead-code issue, introduces none.

48 Unused files

File imported nowhere — delete (or import) it.

     src/hooks/useDelay.ts
     src/hooks/useDraft.ts
     src/pages/NoGrants.tsx
     src/pages/OAuth.tsx
     src/services/encryption.ts
     src/types/global.ts
     src/types/vitest.ts
     src/components/graphs/TaskHoursByMonthGraph.tsx
     src/components/tables/Link.tsx
     src/context/LoopIndex/index.tsx
…and 38 more

63 Unused exports $\textcolor{green}{-1}$

Exported symbol with no references outside its own file — un-export it, or delete it if unused entirely

$\textcolor{green}{-}$ src/context/Theme.tsx : logoColors
     src/context/Theme.tsx : intensifiedOutlineThick
     src/context/Theme.tsx : tableAlternateRowsSx
     src/context/Theme.tsx : draggableChipIconSx
     src/context/Theme.tsx : hiddenButAccessibleInput
     src/context/Theme.tsx : primaryColoredBackground_hovered
     src/context/Theme.tsx : detailsPanelBgColor
     src/context/Theme.tsx : menuBackgroundColor
     src/context/Theme.tsx : flexGrowToSiblingsSx
     src/context/Theme.tsx : shardTableRow
…and 54 more

26 Unused exported types

Exported type with no references outside its own file — un-export it, or delete it if unused entirely

     src/utils/billing-utils.ts : FREE_GB_BY_TIER
     src/types/index.ts : InferredSchemas
     src/types/index.ts : Shard
     src/components/shared/WizardDialog/index.ts : WizardStep
     src/api/dataPlanes.ts : AwsDnsEntry
     src/stores/ShardDetail/types.ts : TaskShardDetailsWithShard
     src/stores/ShardDetail/types.ts : ShardDetails
     src/components/tables/Logs/types.ts : RefreshLogsFunction
     src/types/schemaModels.ts : CollectionSchema
     src/components/editor/Bindings/types.ts : SelectedCollectionChangeData
…and 16 more

14 Unused exported enum members

An enum member referenced nowhere

     src/services/supabase.ts : CONNECTOR_TAGS
     src/services/supabase.ts : DRAFTS_EXT
     src/services/supabase.ts : TASKS_BY_DAY
     src/stores/Tables/hooks.ts : accessGrants
     src/stores/Tables/hooks.ts : accessLinks
     src/stores/Tables/hooks.ts : billing
     src/stores/Tables/hooks.ts : connectors
     src/stores/Tables/hooks.ts : entitySelector
     src/stores/Tables/hooks.ts : prefixes
     src/stores/Tables/hooks.ts : prefixAlerts
…and 4 more

5 Unused dependencies

In package.json but never imported

     package.json : @mui/lab
     package.json : @testing-library/jest-dom
     package.json : @urql/exchange-retry
     package.json : logrocket-react
     package.json : stripe

3 Unused devDependencies

In package.json devDependencies but never used

     package.json : @types/logrocket-react
     package.json : @types/react-inspector
     package.json : sharp