Add REST API, DB user management, and API documentation

Adds a JSON REST API at /api/v1/ (Bearer token auth via API_KEYS env var)
exposing the full pipeline — email processing, log querying, sender profiles,
purge rules, whitelist, and analysis — for external consumers like OpenClaw.

Adds a /dbusers web UI for generating PostgreSQL roles with read_only,
modify, or full permission levels; credentials shown once and never stored.

Includes Alembic migration 0005 for the db_api_users tracking table and
API.md with full endpoint documentation and integration examples.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

migrations/versions/0005_add_db_api_users.py

@@ -0,0 +1,51 @@
+"""Add db_api_users table
+
+Revision ID: 0005
+Revises: 0004
+Create Date: 2026-04-02
+"""
+from __future__ import annotations
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = "0005"
+down_revision: Union[str, None] = "0004"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.execute("CREATE TYPE db_permission_level AS ENUM ('read_only', 'modify', 'full')")
+    op.create_table(
+        "db_api_users",
+        sa.Column(
+            "id",
+            postgresql.UUID(as_uuid=True),
+            primary_key=True,
+            server_default=sa.text("gen_random_uuid()"),
+        ),
+        sa.Column("username", sa.Text, nullable=False, unique=True),
+        sa.Column(
+            "permission_level",
+            postgresql.ENUM("read_only", "modify", "full", name="db_permission_level", create_type=False),
+            nullable=False,
+        ),
+        sa.Column("description", sa.Text),
+        sa.Column("is_active", sa.Boolean, nullable=False, server_default="TRUE"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()")),
+        sa.Column("last_used_at", sa.DateTime(timezone=True)),
+    )
+    op.create_index(
+        "idx_db_api_users_username",
+        "db_api_users",
+        [sa.text("LOWER(username)")],
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("db_api_users")
+    op.execute("DROP TYPE IF EXISTS db_permission_level")