feat(portal): M10.1 — fill the 10 customer-area shells

Four real surfaces wired to tenant-registry (settings, settings/api-keys CRUD, audit pagination, products live entitlements), five forward-looking empty states with CTAs. 56 vitest tests + 10 Playwright canaries. lib/format.ts consolidates date helpers.

Refs: M10.1

src/lib/tenant-registry.test.ts

@@ -1,10 +1,14 @@
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import {
+  createAPIKey,
   createTenant,
+  fetchAPIKeys,
+  fetchAudit,
   fetchCatalog,
   fetchEntitlements,
   fetchTenantBySlug,
   requestProduct,
+  revokeAPIKey,
   startTrial,
   type Tenant,
 } from "./tenant-registry";
@@ -198,3 +202,119 @@ describe("coverage gaps", () => {
     await expect(fetchCatalog()).rejects.toThrow();
   });
 });
+
+describe("fetchAPIKeys", () => {
+  test("happy path", async () => {
+    globalThis.fetch = mockJSON(200, {
+      items: [
+        { id: "1", tenant_id: "t1", name: "k1", scopes: [], prefix: "bp_a", created_at: "x" },
+      ],
+    });
+    const list = await fetchAPIKeys("t1");
+    expect(list).toHaveLength(1);
+  });
+  test("404 → []", async () => {
+    globalThis.fetch = mockJSON(404, {});
+    expect(await fetchAPIKeys("t1")).toEqual([]);
+  });
+  test("non-200 throws", async () => {
+    globalThis.fetch = mockJSON(500, {});
+    await expect(fetchAPIKeys("t1")).rejects.toThrow();
+  });
+});
+
+describe("createAPIKey", () => {
+  test("201 returns plaintext", async () => {
+    globalThis.fetch = mockJSON(201, {
+      api_key: { id: "1", tenant_id: "t1", name: "k", scopes: [], prefix: "bp_a", created_at: "x" },
+      plaintext: "bp_abc123",
+    });
+    const res = await createAPIKey({ tenant_id: "t1", name: "k" });
+    expect(res.ok).toBe(true);
+    if (res.ok) expect(res.plaintext).toBe("bp_abc123");
+  });
+  test("404 → tenant_not_found", async () => {
+    globalThis.fetch = mockJSON(404, {});
+    expect(await createAPIKey({ tenant_id: "t1", name: "k" })).toEqual({
+      ok: false,
+      error: "tenant_not_found",
+    });
+  });
+  test("400 → invalid_input", async () => {
+    globalThis.fetch = mockJSON(400, {});
+    expect(await createAPIKey({ tenant_id: "t1", name: "" })).toEqual({
+      ok: false,
+      error: "invalid_input",
+    });
+  });
+  test("409 → name_taken", async () => {
+    globalThis.fetch = mockJSON(409, {});
+    expect(await createAPIKey({ tenant_id: "t1", name: "k" })).toEqual({
+      ok: false,
+      error: "name_taken",
+    });
+  });
+  test("unexpected status", async () => {
+    globalThis.fetch = mockJSON(500, {});
+    expect(await createAPIKey({ tenant_id: "t1", name: "k" })).toEqual({
+      ok: false,
+      error: "unexpected_500",
+    });
+  });
+});
+
+describe("revokeAPIKey", () => {
+  test("204 → ok", async () => {
+    globalThis.fetch = vi.fn<typeof fetch>(async () => new Response(null, { status: 204 }));
+    expect(await revokeAPIKey("k1")).toEqual({ ok: true });
+  });
+  test("404 → not_found", async () => {
+    globalThis.fetch = mockJSON(404, {});
+    expect(await revokeAPIKey("k1")).toEqual({ ok: false, error: "not_found" });
+  });
+  test("unexpected status", async () => {
+    globalThis.fetch = mockJSON(500, {});
+    expect(await revokeAPIKey("k1")).toEqual({ ok: false, error: "unexpected_500" });
+  });
+});
+
+describe("fetchAudit", () => {
+  test("happy path with filters", async () => {
+    const spy = mockJSON(200, {
+      items: [{ id: 1, action: "tenant.created", created_at: "x" }],
+      next_cursor: 1,
+    });
+    globalThis.fetch = spy;
+    const res = await fetchAudit({
+      tenant_id: "t1",
+      product: "certifai",
+      actor_id: "u1",
+      action: "tenant.created",
+      since: "2026-05-01T00:00:00Z",
+      until: "2026-05-20T00:00:00Z",
+      limit: 50,
+      cursor: 10,
+    });
+    expect(res.items).toHaveLength(1);
+    expect(res.next_cursor).toBe(1);
+    const url = String(spy.mock.calls[0]![0]);
+    expect(url).toContain("tenant_id=t1");
+    expect(url).toContain("product=certifai");
+    expect(url).toContain("actor_id=u1");
+    expect(url).toContain("action=tenant.created");
+    expect(url).toContain("limit=50");
+    expect(url).toContain("cursor=10");
+  });
+  test("no filters", async () => {
+    const spy = mockJSON(200, { items: [] });
+    globalThis.fetch = spy;
+    const res = await fetchAudit({});
+    expect(res.items).toEqual([]);
+    const url = String(spy.mock.calls[0]![0]);
+    expect(url).toBe("http://test:1234/v1/audit?");
+  });
+  test("non-200 throws", async () => {
+    globalThis.fetch = mockJSON(500, {});
+    await expect(fetchAudit({ tenant_id: "t1" })).rejects.toThrow();
+  });
+});