Enforce API key quota within the database transaction

tests/http-state.test.mjs

@@ -155,3 +155,20 @@ test('HTTP API key creation, private listing, MCP use and revocation form a comp
  assert.deepEqual(revoked.data.anahtarlar,[]);
  assert.equal((await request('/mcp','POST',rpc,anahtar)).status,401);
 });
+
+test('concurrent API key requests never exceed quota and malformed input creates nothing',async()=>{
+ const auth=signToken({email:'quota-http@example.test',name:'Quota QA',isAdmin:true});
+ const pending=Array.from({length:16},(_,i)=>request('/api/me/apikeys','POST',{ad:`QA ${i}`},auth));
+ const results=await Promise.all(pending);
+ assert.equal(results.filter(r=>r.status===200).length,10);
+ assert.equal(results.filter(r=>r.status===402&&r.data.kod==='KOTA_ASILDI').length,6);
+ const keys=await request('/api/me/apikeys','GET',null,auth);
+ assert.equal(keys.data.anahtarlar.length,10);
+ await request('/api/me/apikeys?id='+keys.data.anahtarlar[0].id,'DELETE',null,auth);
+ const invalid=await fetch(base+'/api/me/apikeys',{method:'POST',headers:{Authorization:'Bearer '+auth,'Content-Type':'application/json'},body:'{broken'});
+ assert.equal(invalid.status,400);
+ assert.equal((await request('/api/me/apikeys','POST',{ad:{}},auth)).status,400);
+ assert.equal((await request('/api/me/apikeys','GET',null,auth)).data.anahtarlar.length,9);
+ assert.equal((await request('/api/me/apikeys','POST',{ad:'replacement'},auth)).status,200);
+ assert.equal((await request('/api/me/apikeys','PUT',{},auth)).status,405);
+});