feat: add platform key usage to mcp auth

crates/crank-registry/src/postgres.rs

@@ -584,6 +584,36 @@ impl PostgresRegistry {
         rows.iter().map(map_platform_api_key_record).collect()
     }
 
+    pub async fn get_platform_api_key_by_secret_for_workspace_slug(
+        &self,
+        workspace_slug: &str,
+        secret_hash: &str,
+    ) -> Result<Option<PlatformApiKeyRecord>, RegistryError> {
+        let row = sqlx::query(
+            "select
+                k.id,
+                k.workspace_id,
+                k.name,
+                k.prefix,
+                k.scopes_json,
+                k.status,
+                to_char(k.created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
+                to_char(k.last_used_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as last_used_at
+             from platform_api_keys k
+             join workspaces w on w.id = k.workspace_id
+             where w.slug = $1
+               and k.secret_hash = $2
+               and k.status = 'active'
+             limit 1",
+        )
+        .bind(workspace_slug)
+        .bind(secret_hash)
+        .fetch_optional(&self.pool)
+        .await?;
+
+        row.as_ref().map(map_platform_api_key_record).transpose()
+    }
+
     pub async fn create_platform_api_key(
         &self,
         request: CreatePlatformApiKeyRequest<'_>,
@@ -680,6 +710,32 @@ impl PostgresRegistry {
         Ok(())
     }
 
+    pub async fn touch_platform_api_key(
+        &self,
+        workspace_id: &WorkspaceId,
+        key_id: &PlatformApiKeyId,
+        used_at: &str,
+    ) -> Result<(), RegistryError> {
+        let result = sqlx::query(
+            "update platform_api_keys
+                set last_used_at = $3::timestamptz
+              where workspace_id = $1 and id = $2",
+        )
+        .bind(workspace_id.as_str())
+        .bind(key_id.as_str())
+        .bind(used_at)
+        .execute(&self.pool)
+        .await?;
+
+        if result.rows_affected() == 0 {
+            return Err(RegistryError::PlatformApiKeyNotFound {
+                key_id: key_id.as_str().to_owned(),
+            });
+        }
+
+        Ok(())
+    }
+
     pub async fn create_invocation_log(
         &self,
         request: CreateInvocationLogRequest<'_>,