Add PdfApiKey model and key storage helpers

Adds a Prisma model for per-student Clean PDF API keys plus a
hand-written migration (no local Postgres to run `migrate dev`
against). getOrCreatePdfKey/regenerateKey wrap the model with
lazy-creation and rotation logic on top of generatePdfKey().

prisma/schema.prisma

@@ -47,6 +47,7 @@ model User {
   questionMessages     StudentQuestionMessage[]
   wrappedRuns          WrappedRun[]
   toolUsages           ToolUsage[]
+  pdfApiKey            PdfApiKey?
 }
 
 // Obsidian Wrapped — агрегаты прогона (БЕЗ имён/текстов заметок; обработка волта 100% client-side)
@@ -82,6 +83,16 @@ model ToolUsage {
   @@index([createdAt])
 }
 
+// Чистый PDF — персональный API-ключ студента (Zotero/curl)
+model PdfApiKey {
+  id        String   @id @default(cuid())
+  userId    String   @unique
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  key       String   @unique // sbpdf_<random>, показывается студенту на /tools/clean-pdf
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+}
+
 model Session {
   id             String   @id @default(cuid())
   userId         String