update erd db and add display name to user access table

backend/database/erd_schema.sql

@@ -3,11 +3,13 @@
 -- Source: ERD_dashboard.png (updated 2026-09-09 for GM cycle-close flow)
 --
 --   user_access.status: active | inactive | superadmin
+--   user_access.display_name: shown in dashboard UI (login still uses user_name)
 --   (Django syncs is_active/is_staff/is_superuser from status on save:
 --    inactive => all false; superadmin => is_active/is_superuser true,
 --    is_staff false; active => is_active true, is_superuser false, is_staff
 --    left untouched so operators can be marked staff)
 --   user_access → sites → kandang → cycles
+--   user_access → api_keys (X-API-Key auth; hashed at rest)
 --   cycles.status: active | pending_close | closed (GM approves end_date)
 --   cycles.close_requested_by_id → user_access (optional)
 --   kandang → flock → iot_panel
@@ -26,6 +28,7 @@
 CREATE TABLE IF NOT EXISTS user_access (
     user_id         SERIAL PRIMARY KEY,
     user_name       VARCHAR(30)  NOT NULL UNIQUE,
+    display_name    VARCHAR(100) NOT NULL,
     password        VARCHAR(128) NOT NULL,
     last_login      TIMESTAMP WITH TIME ZONE,
     is_superuser    BOOLEAN      NOT NULL DEFAULT FALSE,
@@ -51,6 +54,24 @@ CREATE TABLE IF NOT EXISTS user_access_user_permissions (
     permission_id INTEGER NOT NULL REFERENCES auth_permission (id) ON DELETE CASCADE
 );
 
+-- -----------------------------------------------------------------------------
+-- 1b. API Keys (machine auth via X-API-Key; FK → user_access)
+-- -----------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS api_keys (
+    id            SERIAL PRIMARY KEY,
+    user_id       INTEGER     NOT NULL REFERENCES user_access (user_id) ON DELETE CASCADE,
+    name          VARCHAR(100) NOT NULL,
+    prefix        VARCHAR(12)  NOT NULL,
+    key_hash      VARCHAR(64)  NOT NULL,
+    is_active     BOOLEAN      NOT NULL DEFAULT TRUE,
+    last_used_at  TIMESTAMP WITH TIME ZONE,
+    created_at    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_api_keys_user_id ON api_keys (user_id);
+CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys (prefix);
+
 -- -----------------------------------------------------------------------------
 -- 2. Sites
 -- -----------------------------------------------------------------------------