Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/auth/apikey_test.go

@@ -0,0 +1,28 @@
+package auth
+
+import (
+	"testing"
+)
+
+func TestHashAPIKeyDeterministic(t *testing.T) {
+	t.Parallel()
+	a := HashAPIKey("dk_test_secret_value")
+	b := HashAPIKey("dk_test_secret_value")
+	if a != b {
+		t.Fatalf("hash not deterministic")
+	}
+	if len(a) != 64 {
+		t.Fatalf("expected sha256 hex length 64, got %d", len(a))
+	}
+	if HashAPIKey("other") == a {
+		t.Fatal("different keys must not collide")
+	}
+}
+
+func TestHashAPIKeyEmpty(t *testing.T) {
+	t.Parallel()
+	got := HashAPIKey("")
+	if len(got) != 64 {
+		t.Fatalf("empty input still hashes: len=%d", len(got))
+	}
+}