Add PdfApiKey model and key storage helpers

Adds a Prisma model for per-student Clean PDF API keys plus a
hand-written migration (no local Postgres to run `migrate dev`
against). getOrCreatePdfKey/regenerateKey wrap the model with
lazy-creation and rotation logic on top of generatePdfKey().

prisma/migrations/20260706120000_add_pdf_api_key/migration.sql

@@ -0,0 +1,14 @@
+-- Чистый PDF — персональный API-ключ студента (Zotero/curl)
+CREATE TABLE "PdfApiKey" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "PdfApiKey_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "PdfApiKey_userId_key" ON "PdfApiKey"("userId");
+CREATE UNIQUE INDEX "PdfApiKey_key_key" ON "PdfApiKey"("key");
+
+ALTER TABLE "PdfApiKey" ADD CONSTRAINT "PdfApiKey_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/schema.prisma

@@ -47,6 +47,7 @@ model User {
   questionMessages     StudentQuestionMessage[]
   wrappedRuns          WrappedRun[]
   toolUsages           ToolUsage[]
+  pdfApiKey            PdfApiKey?
 }
 
 // Obsidian Wrapped — агрегаты прогона (БЕЗ имён/текстов заметок; обработка волта 100% client-side)
@@ -82,6 +83,16 @@ model ToolUsage {
   @@index([createdAt])
 }
 
+// Чистый PDF — персональный API-ключ студента (Zotero/curl)
+model PdfApiKey {
+  id        String   @id @default(cuid())
+  userId    String   @unique
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  key       String   @unique // sbpdf_<random>, показывается студенту на /tools/clean-pdf
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+}
+
 model Session {
   id             String   @id @default(cuid())
   userId         String