[MeharPro]

An app can now have extra keys. The owner merged the paying customer Glyco's two apps (the one his live site reports to and the one his plan was bought on) and asked that the key of the app that went away keep reporting into the merged app.

• Migration 0022 adds app_keys (token, project_token, created).
• Ingest resolves a batch's token to its app's own key (canonicalToken, cached like knownToken was: 5 min for a known key, 30 s for an unknown one). It does this before the observe-only check, aggregation, the export index and forwarding, so an extra key's batches count on the app. The raw batch in R2 keeps the key the page sent.
• Precedence: an app's own key always wins over an extra key with the same value. An extra key whose app is gone counts nowhere.
• Deleting an app deletes its extra keys and drops them from the in-memory cache.
• Adding keys: no route writes the table yet. The README ("Extra keys") has the one-line SQL.
• Also fixed: createProject now writes its cache entry in the new shape.

Checks:

• test/app-keys.test.ts (3 tests) and a strict worker typecheck pass. The whole collector suite passes too, except index.test.ts "a client that goes away cannot cancel ingest".
• That test fails here, on this Mac, on main as well, with or without this change. The Mac is under heavy load, and the test's 5 ms window before the R2 put doesn't hold. Its assertion runs before any code this PR changes, so CI is the check for it.

🤖 Generated with Claude Code