feat(email): notify users of new API keys

[FujiwaraChoki]

What changed

• send an Amazon SES security notification after a user creates an API key
• include only the key name and visible prefix, never the plaintext secret
• escape user-controlled values in the HTML email
• keep notification delivery best-effort so email failures do not invalidate a persisted key
• add focused tests for content safety and delivery behavior

Why

Users should be alerted when credentials are created for their account so unexpected activity can be detected and revoked quickly.

Validation

• Python compilation passed for the changed modules and test file
• standalone email safety checks passed
• git diff --check passed
• focused pytest collection is currently blocked by the repository dependency mismatch between pydantic-ai and griffe

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
supoclip	Building	Preview, Comment	Jul 11, 2026 2:04pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 15ff3e7d56

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Return the one-time key before awaiting SES

When SES is configured but slow or temporarily unreachable, this await keeps the create request open after ApiKeyRepository.create_api_key has already committed the row. The frontend only reveals the plaintext key from this response (frontend/src/app/settings/api-keys/page.tsx), so a route/client timeout here leaves the user with an active API key whose secret can never be recovered. Send the notification out of band or otherwise avoid blocking the one-time secret response on SES delivery.

Useful? React with 👍 / 👎.