Add SQLite store for email→key mapping; fix key/list (returns token strings); flat 5 budget

README.md

@@ -82,7 +82,10 @@ points. Remaining work before production:
       → `order.processed` (every payment), `new member` (first only), `firstPayment` flag
 - [x] Verify Cloudron user-creation API payload (role/group assignment)
       → `POST /api/v1/users` with `{username, email, displayName, role, active}`
-- [ ] Add a persistent store (SQLite/Postgres) for email→key mapping
-- [ ] Add HMAC signature verification for the OC webhook
+      → group assignment via `PUT /api/v1/users/:userId/groups` with `{groupIds: [...]}`
+- [x] Add a persistent store (SQLite) for email→key mapping
+      → `key/list` returns token strings (not objects), so we store email→token locally
+- [x] Verify LiteLLM key/generate + key/list payload shapes against live gateway
+      → `key/generate` returns `{key: "sk-..."}`; `key/list` returns `{keys: ["<token>", ...]}`
+- [ ] Add HMAC signature verification for the OC webhook (if OC supports it)
 - [ ] Wire the OIDC addon for admin access
-- [ ] Verify LiteLLM key/generate + key/list payload shapes against live gateway