Task Journal — DEV-1010 key rotation docs

Task

linear-id: DEV-1010 (docs half of DEV-1006)
title: Key-management page, Secret Key rotation runbook, fix rotation facts, deprecate regenerate-secret
worktree: documentation_mintlify.worktrees/dev-1010-key-rotation-docs (branch sam/dev-1010-key-rotation-docs)
skill: docs-new-feature

Verify behaviour against code (dash-mono, auth-service, api-gateway, migrations — origin/main)
New page docs/project-keys.mdx + nav (Get Started, after Users and Access)
Fix reference/v4/project-settings.mdx “grace period (seconds)” → up to 1 hour; mark regenerate-secret deprecated (page + rest-api-v4.yaml)
Key location path fixed in reference/overview.mdx, reference/v4/authentication.mdx, rest-api.yaml, quickstart, troubleshooting, mcp-server
Changelog entry
PR, CodeRabbit, merge, verify live

Dashboard: Settings → Developer (/project-settings/developer, group “Developer tools”), section “Keys”: Project key + API key read-only (Reveal/Copy); “Secret keys” table Name/Key/Created, ” of 10”, “Create secret key”. dash-mono apps/frontend/src/views/ProjectSettings/Developer/**. Shipped in dash-mono 3.274.0 (2026-06-17).
Limit 10 (SECRET_KEY_LIMIT, backend + frontend); last key cannot be deleted; full key copyable any time.
Manage = RBAC manageTarget → manager (administrator inherits); qonversion/migrations rbac_auth_item_child.
Propagation: auth-service per-pod BigCache, lifetime 1h (internal/config/config_structure.go, config.yml), no invalidation (ProjectSecretTokenGenerated job is empty). Failed lookups not cached → new key works immediately. api-gateway passes the uncached auth-service client to its auth middlewares (internal/app/wire_gen.go).
regenerate-secret (v1, open gateway, v4 via api-gateway → dash) = create new + delete oldest immediately.
API-key regenerate was split out of DEV-1006 into DEV-1064 (dash-mono 12c64c55aa) — not on main, so the ticket’s “API Key regenerate runbook” is documented as “not possible in the dashboard”.
v3 POST /v3/users/{uid}/purchases is on the AuthByAccessToken router (Project Key) — the “requires Secret Key” error was already fixed in 5bb35e3.

api-gateway secret-key auth strips test_ and never selects sandbox (removeTestPrefix, “We do not support sandbox mode for API”), while reference/v4/authentication.mdx claims test_sk_ → sandbox.
auth-service Redis “persistent cache” has no TTL and is read on DB failure — a deleted key can authenticate during a DB outage.