Add service accounts and operator mode

Service accounts (SERVICE-ACCOUNTS.md) are a scoped, non-human credential:
not a users row, so they never touch OIDC sync, login or the is_admin flag.
Instance scope can create a team and mint a team-scoped account for it;
team scope is owner-equivalent for that one team and nothing else. This is
what unblocks terdut-operator's DESIGN.md §6 — no more impersonating a
human admin, and a real rotation story instead of the unworkable
delete-and-re-bootstrap /api/bootstrap can't actually do.

- migration 014: service_accounts + service_account_keys
- POST /api/service-accounts, POST/DELETE .../keys, GET ?name= self-lookup
- AuthMiddleware resolves a tdsa_-prefixed key to a distinct principal;
  a team-scoped account gets a synthetic single membership so
  requireTeamMember/requireTeamOwner work on it unmodified
- handleCreateTeam accepts an instance-scoped caller; the team it creates
  has no human owner, which is the expected shape for one an operator is
  about to hand a team-scoped credential to

Operator mode (TERDUT_OPERATOR_MODE / values.operatorMode) declares an
install gitops-managed: session and user-API-key writes to teams,
escalation policies, dead man's switches and integrations get 403
reason=operator_managed, while a service account's writes still go
through. Team membership/invites and the schedule are deliberately left
out — never gitops-managed by design, and still human day-to-day work.
/api/auth/config reports operator_mode so the web UI can grey these
sections out from the start rather than only after a write fails.

Also: GET /api/version (both terdut-tui and terdut-operator currently
detect server capability by route-probing; this gives them a real answer),
and a PUT for dead man's switches so a reconciler can update one in place
instead of deleting and recreating it.

internal/api/router.go

@@ -14,8 +14,12 @@ import (
 // NewRouter builds the HTTP surface. notify is passed through to the webhook,
 // the only handler that has to decide where a new incident's page goes; a zero
 // notify disables notifications. Dead man's switches are per team and read from
-// the database, so nothing about them is wired in here.
-func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config) http.Handler {
+// the database, so nothing about them is wired in here. version is reported
+// verbatim by GET /api/version, unauthenticated like /healthz: a client
+// deciding whether it can talk to this server — terdut-tui, terdut-operator —
+// needs to ask before it holds a credential for it, and the version is not a
+// secret.
+func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config, version string) http.Handler {
 	// One limiter each, both process-wide for the life of the router: login
 	// counts failed passwords, sign-up counts account creation, and mixing the
 	// two would let a burst of sign-ups lock somebody out of logging in.
@@ -30,6 +34,9 @@ func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config) http.Handler
 	r.Get("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		respond(w, http.StatusOK, map[string]string{"status": "ok"})
 	})
+	r.Get("/api/version", func(w http.ResponseWriter, r *http.Request) {
+		respond(w, http.StatusOK, map[string]string{"version": version})
+	})
 
 	// Unauthenticated: bootstrap, the Alertmanager webhook receiver, and the
 	// Acknowledge button in a push notification. The last one is authorised by
@@ -151,11 +158,26 @@ func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config) http.Handler
 		r.Post("/api/incidents/{id}/notes", handleCreateNote(db))
 		r.Delete("/api/incidents/{id}/notes/{eventID}", handleDeleteNote(db))
 
+		// Service accounts: a scoped, non-human credential for automation
+		// (terdut-operator, most likely) that needs to manage the resources
+		// below without impersonating a human user. See SERVICE-ACCOUNTS.md.
+		r.Get("/api/service-accounts", handleListServiceAccounts(db))
+		r.Post("/api/service-accounts", handleCreateServiceAccount(db))
+		r.Post("/api/service-accounts/{id}/keys", handleCreateServiceAccountKey(db))
+		r.Delete("/api/service-accounts/{id}/keys/{keyID}", handleDeleteServiceAccountKey(db))
+
+		// Operator mode (TERDUT_OPERATOR_MODE) makes every write below refuse a
+		// human caller (a session or a user's own API key) while still letting
+		// a service account through — see OperatorModeBlock. opMode is a no-op
+		// wrapper when the flag is off, so this costs nothing on a server that
+		// never sets it.
+		opMode := OperatorModeBlock(cfg)
+
 		// Teams. A user sees the teams they belong to; an owner configures one.
 		r.Get("/api/teams", handleListTeams(db))
-		r.Post("/api/teams", handleCreateTeam(db))
-		r.Put("/api/teams/{teamID}", handleRenameTeam(db))
-		r.Delete("/api/teams/{teamID}", handleDeleteTeam(db))
+		r.With(opMode).Post("/api/teams", handleCreateTeam(db))
+		r.With(opMode).Put("/api/teams/{teamID}", handleRenameTeam(db))
+		r.With(opMode).Delete("/api/teams/{teamID}", handleDeleteTeam(db))
 		r.Get("/api/teams/{teamID}/members", handleListTeamMembers(db))
 		r.Post("/api/teams/{teamID}/members", handleAddTeamMember(db))
 		r.Delete("/api/teams/{teamID}/members/{userID}", handleRemoveTeamMember(db))
@@ -163,28 +185,31 @@ func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config) http.Handler
 		// A team's own OIDC group binding: which provider groups grant member
 		// and owner access to it.
 		r.Get("/api/teams/{teamID}/oidc-groups", handleGetTeamOIDCGroups(db))
-		r.Put("/api/teams/{teamID}/oidc-groups", handleSetTeamOIDCGroups(db))
+		r.With(opMode).Put("/api/teams/{teamID}/oidc-groups", handleSetTeamOIDCGroups(db))
 
-		// Invite links into this team.
+		// Invite links into this team. Not operator-mode-gated: membership is
+		// deliberately never gitops-managed (see terdut-operator's DESIGN.md
+		// §4.2), so it stays editable regardless of this flag.
 		r.Get("/api/teams/{teamID}/invites", handleListInvites(db))
 		r.Post("/api/teams/{teamID}/invites", handleCreateInvite(db, notify.PublicURL))
 		r.Delete("/api/teams/{teamID}/invites/{inviteID}", handleRevokeInvite(db))
 
 		// A team's escalation ladder: who is paged when nobody answers.
 		r.Get("/api/teams/{teamID}/escalation", handleGetEscalation(db))
-		r.Put("/api/teams/{teamID}/escalation", handleSetEscalation(db))
+		r.With(opMode).Put("/api/teams/{teamID}/escalation", handleSetEscalation(db))
 
 		// A team's own dead man's switches: which of its alerts are heartbeats,
 		// and how long a silence has to last before somebody is paged.
 		r.Get("/api/teams/{teamID}/deadman/switches", handleListTeamDeadman(db))
-		r.Post("/api/teams/{teamID}/deadman/switches", handleCreateTeamDeadman(db))
-		r.Delete("/api/teams/{teamID}/deadman/switches/{switchID}", handleDeleteTeamDeadman(db))
+		r.With(opMode).Post("/api/teams/{teamID}/deadman/switches", handleCreateTeamDeadman(db))
+		r.With(opMode).Put("/api/teams/{teamID}/deadman/switches/{switchID}", handleUpdateTeamDeadman(db))
+		r.With(opMode).Delete("/api/teams/{teamID}/deadman/switches/{switchID}", handleDeleteTeamDeadman(db))
 
 		// Integrations: where a team's alerts come in, and the key that says so.
 		r.Get("/api/teams/{teamID}/integrations", handleListIntegrations(db))
-		r.Post("/api/teams/{teamID}/integrations", handleCreateIntegration(db, notify.PublicURL))
-		r.Patch("/api/teams/{teamID}/integrations/{integrationID}", handleRenameIntegration(db))
-		r.Delete("/api/teams/{teamID}/integrations/{integrationID}", handleDeleteIntegration(db))
+		r.With(opMode).Post("/api/teams/{teamID}/integrations", handleCreateIntegration(db, notify.PublicURL))
+		r.With(opMode).Patch("/api/teams/{teamID}/integrations/{integrationID}", handleRenameIntegration(db))
+		r.With(opMode).Delete("/api/teams/{teamID}/integrations/{integrationID}", handleDeleteIntegration(db))
 
 		// The rota is per team. /api/schedule/current is the exception: it
 		// answers across every team the caller is in, which is what somebody on