Fix milestones 422 + acc-mgr user + reset-apikey endpoint

- Fix: /milestones?project_id= now accepts project_code (str) not just int
- Add: built-in acc-mgr user created on wizard init (account-manager role, no login, undeletable)
- Add: POST /users/{id}/reset-apikey with permission-based access control
- Add: GET /auth/me/apikey-permissions for frontend capability check
- Add: user.reset-self-apikey and user.reset-apikey permissions
- Protect admin and acc-mgr accounts from deletion
- Block acc-mgr from login (/auth/token returns 403)

app/api/routers/auth.py

@@ -24,6 +24,9 @@ async def login(form_data: OAuth2PasswordRequestForm = Depends(), db: Session =
                             headers={"WWW-Authenticate": "Bearer"})
     if not user.is_active:
         raise HTTPException(status_code=400, detail="Inactive user")
+    # Built-in acc-mgr account cannot log in interactively
+    if user.username == "acc-mgr":
+        raise HTTPException(status_code=403, detail="This account cannot log in")
     access_token = create_access_token(
         data={"sub": str(user.id)},
         expires_delta=timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
@@ -36,6 +39,36 @@ async def get_me(current_user: models.User = Depends(get_current_user)):
     return current_user
 
 
+class ApiKeyPermissionResponse(BaseModel):
+    can_reset_self: bool
+    can_reset_any: bool
+
+
+@router.get("/me/apikey-permissions", response_model=ApiKeyPermissionResponse)
+async def get_apikey_permissions(
+    current_user: models.User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    """Return the current user's API key reset capabilities."""
+    def _has_perm(perm_name: str) -> bool:
+        if current_user.is_admin:
+            return True
+        if not current_user.role_id:
+            return False
+        perm = db.query(Permission).filter(Permission.name == perm_name).first()
+        if not perm:
+            return False
+        return db.query(RolePermission).filter(
+            RolePermission.role_id == current_user.role_id,
+            RolePermission.permission_id == perm.id,
+        ).first() is not None
+
+    return ApiKeyPermissionResponse(
+        can_reset_self=_has_perm("user.reset-self-apikey"),
+        can_reset_any=_has_perm("user.reset-apikey"),
+    )
+
+
 class PermissionIntrospectionResponse(BaseModel):
     username: str
     role_name: str | None

app/api/routers/misc.py

@@ -136,10 +136,21 @@ def create_milestone(ms: schemas.MilestoneCreate, db: Session = Depends(get_db),
 
 
 @router.get("/milestones", response_model=List[schemas.MilestoneResponse], tags=["Milestones"])
-def list_milestones(project_id: int = None, status_filter: str = None, db: Session = Depends(get_db)):
+def list_milestones(project_id: str = None, status_filter: str = None, db: Session = Depends(get_db)):
     query = db.query(MilestoneModel)
     if project_id:
-        query = query.filter(MilestoneModel.project_id == project_id)
+        # Resolve project_id by numeric id or project_code
+        resolved_project = None
+        try:
+            pid = int(project_id)
+            resolved_project = db.query(models.Project).filter(models.Project.id == pid).first()
+        except (ValueError, TypeError):
+            pass
+        if not resolved_project:
+            resolved_project = db.query(models.Project).filter(models.Project.project_code == project_id).first()
+        if not resolved_project:
+            raise HTTPException(status_code=404, detail="Project not found")
+        query = query.filter(MilestoneModel.project_id == resolved_project.id)
     if status_filter:
         query = query.filter(MilestoneModel.status == status_filter)
     return query.order_by(MilestoneModel.due_date.is_(None), MilestoneModel.due_date.asc()).all()

app/api/routers/users.py

@@ -173,6 +173,11 @@ def delete_user(
         raise HTTPException(status_code=404, detail="User not found")
     if current_user.id == user.id:
         raise HTTPException(status_code=400, detail="You cannot delete your own account")
+    # Protect built-in accounts from deletion
+    if user.is_admin:
+        raise HTTPException(status_code=400, detail="Admin accounts cannot be deleted")
+    if user.username == "acc-mgr":
+        raise HTTPException(status_code=400, detail="The acc-mgr account is a built-in account and cannot be deleted")
     try:
         db.delete(user)
         db.commit()
@@ -182,6 +187,65 @@ def delete_user(
     return None
 
 
+@router.post("/{identifier}/reset-apikey")
+def reset_user_apikey(
+    identifier: str,
+    db: Session = Depends(get_db),
+    current_user: models.User = Depends(get_current_user),
+):
+    """Reset (regenerate) a user's API key.
+
+    Permission rules:
+    - user.reset-apikey: can reset any user's API key
+    - user.reset-self-apikey: can reset only own API key
+    - admin: can reset any user's API key
+    """
+    import secrets
+    from app.models.apikey import APIKey
+
+    target_user = _find_user_by_id_or_username(db, identifier)
+    if not target_user:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    is_self = current_user.id == target_user.id
+    can_reset_any = _has_global_permission(db, current_user, "user.reset-apikey")
+    can_reset_self = _has_global_permission(db, current_user, "user.reset-self-apikey")
+
+    if not (can_reset_any or (is_self and can_reset_self)):
+        raise HTTPException(status_code=403, detail="API key reset permission required")
+
+    # Find existing active API key for target user, or create one
+    existing_key = db.query(APIKey).filter(
+        APIKey.user_id == target_user.id,
+        APIKey.is_active == True,
+    ).first()
+
+    new_key_value = secrets.token_hex(32)
+
+    if existing_key:
+        # Deactivate old key
+        existing_key.is_active = False
+        db.flush()
+
+    # Create new key
+    new_key = APIKey(
+        key=new_key_value,
+        name=f"{target_user.username}-key",
+        user_id=target_user.id,
+        is_active=True,
+    )
+    db.add(new_key)
+    db.commit()
+    db.refresh(new_key)
+
+    return {
+        "user_id": target_user.id,
+        "username": target_user.username,
+        "api_key": new_key_value,
+        "message": "API key has been reset. Please save this key — it will not be shown again.",
+    }
+
+
 class WorkLogResponse(BaseModel):
     id: int
     task_id: int