Split MCP and approval agent keys

crates/crank-registry/src/migrations.rs

@@ -148,11 +148,14 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
             name text not null,
             prefix text not null,
             secret_hash text not null,
+            key_kind text not null default 'mcp_client',
             scopes_json jsonb not null,
             status text not null,
             created_at timestamptz not null,
             last_used_at timestamptz null,
-            revoked_at timestamptz null
+            revoked_at timestamptz null,
+            expires_at timestamptz null,
+            allowed_origins_json jsonb not null default '[]'::jsonb
         )",
     )
     .execute(pool)
@@ -166,6 +169,19 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
     query("alter table platform_api_keys add column if not exists agent_id text null")
         .execute(pool)
         .await?;
+    query(
+        "alter table platform_api_keys add column if not exists key_kind text not null default 'mcp_client'",
+    )
+    .execute(pool)
+    .await?;
+    query("alter table platform_api_keys add column if not exists expires_at timestamptz null")
+        .execute(pool)
+        .await?;
+    query(
+        "alter table platform_api_keys add column if not exists allowed_origins_json jsonb not null default '[]'::jsonb",
+    )
+    .execute(pool)
+    .await?;
 
     query(
         "insert into workspaces (