Release 0.129.0

[tudddorrr]

Admin API authentication system

• Introduced a brand new AdminAPIKey entity and authentication flow for server-to-server administrative operations, separate from the existing game-facing API keys and dashboard user sessions
• Added a fourth routing layer at /admin/v1/ with dedicated middleware, route info detection, rate limiting, and a requireAdminScopes policy gate with read:stats, write:stats and * scopes
• Created dashboard CRUD endpoints under /games/:gameId/admin-api-keys for creating, listing, updating scopes, and revoking these keys

Activity log actor abstraction

• Refactored GameActivity to accept either a User or an AdminAPIKey as the actor, making the user field nullable and adding an adminAPIKey foreign key
• Updated all ~40 call sites across the codebase to use a unified actor parameter instead of the old user-only approach, with activity descriptions now displaying "Key ending in XXXX" for admin API key actions
• Added three new activity types (ADMIN_API_KEY_CREATED, ADMIN_API_KEY_REVOKED, ADMIN_API_KEY_UPDATED) to track admin key lifecycle

Cache and response invalidation refactoring

• Moved stat index response cache clearing from middleware (clearStatIndexResponseCache) to deferred post-handler clearing via deferClearResponseCache, ensuring the cache is invalidated after the response is sent rather than as route middleware
• Extracted a static getCacheKeyForGame method on the Integration entity and used it consistently in triggerIntegrations and the delete handler, replacing inline cache key strings
• Added cache busting for admin API key tokens on revoke/update via em.clearCache

API key listing enhancement and revoked-key filtering

• The existing API key list endpoint now derives and returns each key's last 4 characters (keyEnding) by regenerating the JWT token, mirroring the admin API key UX
• Changed getAPIKeyFromToken to include revokedAt: null in the query filter rather than relying on the caller to check, and removed the revokedAt guard from recordLastUsedAt to simplify the middleware

Infrastructure hardening

• Refactored drainApiKeyLastUsed to support both API key and admin API key hashes via a shared drainKeyForEntity helper, with per-entry try/catch and Sentry capture so a single bad entry doesn't stall the task
• Replaced several findOne + assert patterns in tests with findOneOrFail, and used optional chaining for null-safe activity access