feat: add runtime policy and observability

src/api/user.rs

@@ -697,6 +697,16 @@ async fn create_api_key(
     if !email_verified {
         return Err(AppError::new(ErrorCode::EmailNotVerified, "请先验证邮箱"));
     }
+    if !settings::runtime_policy(&state)
+        .await?
+        .features
+        .api_key_enabled
+    {
+        return Err(AppError::new(
+            ErrorCode::Forbidden,
+            "API Key 功能当前已关闭",
+        ));
+    }
 
     let billing = billing::get_user_billing(&state, user_id).await?;
     if !billing.plan.feature_api_enabled {
@@ -796,6 +806,16 @@ async fn rotate_api_key(
     if !email_verified {
         return Err(AppError::new(ErrorCode::EmailNotVerified, "请先验证邮箱"));
     }
+    if !settings::runtime_policy(&state)
+        .await?
+        .features
+        .api_key_enabled
+    {
+        return Err(AppError::new(
+            ErrorCode::Forbidden,
+            "API Key 功能当前已关闭",
+        ));
+    }
 
     let (full_key, key_prefix) = generate_api_key();
     let key_hash = context::api_key_hash(&full_key, &state.config.api_key_pepper)?;