Port upstream #1833: filter API key list by privilege

frontend/docs/api-contracts.md

@@ -49,6 +49,8 @@ Team requests share the cookie session and `credentials: 'include'`. The adminis
 | `getApiKey(id, signal?)`                 | `GET /api/prism/v1/apikeys/{encoded id}`               | Full key, retrieved only on an explicit copy action                                                                                                              |
 | `deleteApiKey(id)`                       | `DELETE /api/prism/v1/apikeys/{encoded id}`            | Checked success; backend returns `{keyId, keyName, message}`                                                                                                     |
 
+API key listing accepts `?privilege=reader|ingestor|admin|writer|editor|superadmin` (alias `priviledge`), matching direct or group-inherited role privileges by kind (an admin key does not match `reader`, and a super-admin key does not match `admin`). Each entry's `roles` lists direct roles only. Unknown or differently cased values, or a repeated parameter, return 400; unknown parameter names are ignored and leave the list unfiltered.
+
 API key expiry is optional: `ttlSeconds` must be an integer from 1800 (30 minutes) through 7776000 (90 days), inclusive; invalid values return 400. Omitted or null TTL means no expiration. Responses include `expiresAt`, a UTC timestamp or null; the frontend also accepts an omitted field from older servers for legacy records. Finite lifetimes are elapsed durations from creation, independent of time zones or daylight saving changes. The creation form defaults to 90 days and offers presets, custom minutes/hours/days, and No expiration. TTL cannot be edited after creation. Expired keys remain listed and deletable; their names remain reserved until deletion.
 
 Both `X-API-KEY` and Bearer authentication return 401 once server time reaches `expiresAt`, and key validation reports false. Temporary API-key sessions, including those created for intra-cluster requests, cannot extend the deadline or refresh as OAuth sessions. Intra-cluster requests on behalf of an expired key return 401. Requests authorized before expiry may finish on the node that authorized them. Expiration changes credential validity, not its assigned roles or an administrator's authority to create other credentials.