feat: move API keys storage to Postgres database instead of localStorage

backend/database.js

@@ -25,7 +25,8 @@ const initDB = async () => {
         role TEXT DEFAULT 'user',
         api_credits INTEGER DEFAULT 10,
         storage_limit_mb INTEGER DEFAULT 500,
-        is_active BOOLEAN DEFAULT false
+        is_active BOOLEAN DEFAULT false,
+        api_keys TEXT
       )
     `);
     
@@ -36,6 +37,12 @@ const initDB = async () => {
     } catch (err) {
       // Ignore if it already exists
     }
+    
+    try {
+      await client.query(`ALTER TABLE profiles ADD COLUMN api_keys TEXT`);
+    } catch (err) {
+      // Ignore if it already exists
+    }
 
     await client.query(`
       CREATE TABLE IF NOT EXISTS projects (

backend/server.js

@@ -116,6 +116,40 @@ app.get('/api/auth/me', authenticate, async (req, res) => {
   }
 });
 
+// 3.5. Get User API Keys
+app.get('/api/user/keys', authenticate, async (req, res) => {
+  try {
+    const profile = await get('SELECT api_keys FROM profiles WHERE id = ?', [req.user.id]);
+    let keys = {};
+    if (profile && profile.api_keys) {
+      try {
+        keys = JSON.parse(profile.api_keys);
+      } catch (e) {
+        // ignore invalid json
+      }
+    }
+    res.json({ keys });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// 3.6. Update User API Keys
+app.put('/api/user/keys', authenticate, async (req, res) => {
+  const { keys } = req.body;
+  if (!keys || typeof keys !== 'object') {
+    return res.status(400).json({ error: 'Invalid keys object' });
+  }
+  
+  try {
+    const keysStr = JSON.stringify(keys);
+    await run('UPDATE profiles SET api_keys = ? WHERE id = ?', [keysStr, req.user.id]);
+    res.json({ success: true });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
 // 4. Get all projects for user
 app.get('/api/projects', authenticate, async (req, res) => {
   try {