feat(#758): add third-party course provider integration API

[jerrymusaga]

Summary

Closes #758.

Implements the full V3 third-party course provider integration API across all six checklist items:

• API contract — POST/GET /api/provider/courses, POST/GET /api/provider/completions, GET /api/provider/lrn-balances/:address
• API key management — admin-only POST/GET/PATCH/DELETE /api/admin/provider-keys; keys are SHA-256-hashed at rest, scoped, and carry per-key rate limits
• Webhook support — POST/GET/DELETE /api/provider/webhooks, delivery log at GET /api/provider/webhooks/:id/deliveries; async fire-and-forget HTTP POST with HMAC-SHA256 payload signing and 10 s timeout
• Rate limits — dedicated providerRateLimiter (300 req/min blanket) keyed on X-Provider-API-Key, fully independent of the user-facing globalLimiter
• SDK — packages/learnvault-provider-sdk (@learnvault/provider-sdk): zero-dependency TypeScript client with CJS + ESM + .d.ts outputs and a verifyWebhookSignature helper
• Documentation — docs/api/provider-integration.md: developer portal covering auth, scopes, all endpoints, webhook event shapes, signature verification recipe, SDK quick-start, and admin key management

New files

Path	Purpose
server/src/db/migrations/021_provider_api.sql	Tables: provider_api_keys, provider_completions, provider_webhooks, provider_webhook_deliveries; columns on courses
server/src/services/provider-keys.service.ts	Key generation (SHA-256 hash), validation, CRUD
server/src/middleware/provider-auth.middleware.ts	requireProviderAuth, requireProviderScope, providerRateLimiter
server/src/controllers/provider.controller.ts	Course submit/list, completion report/list, LRN balance
server/src/controllers/provider-webhooks.controller.ts	Webhook CRUD, delivery list
server/src/services/webhook-delivery.service.ts	Async webhook fan-out with HMAC signing
server/src/controllers/admin-provider-keys.controller.ts	Admin key management
server/src/routes/provider.routes.ts	/api/provider/* route definitions
server/src/routes/admin-provider-keys.routes.ts	/api/admin/provider-keys route definitions
packages/learnvault-provider-sdk/	@learnvault/provider-sdk npm package
docs/api/provider-integration.md	Developer portal documentation

Test plan

• Run npm run migrate — migration 021 should apply cleanly
• Create a provider key via POST /api/admin/provider-keys (admin JWT required) and verify the response includes the api_key field exactly once
• Use the returned key to call POST /api/provider/courses — confirm 401 without key, 403 without courses:write scope, 201 with correct scope
• Submit a duplicate slug — expect 409
• Report a completion for the created course and verify 201; report the same again and verify 409
• Call GET /api/provider/lrn-balances/:address with a wallet that has indexed events — verify balance math
• Register a webhook pointing to a test server (e.g. https://webhook.site), trigger a completion, and confirm delivery in GET /api/provider/webhooks/:id/deliveries
• Verify the X-LearnVault-Signature header can be validated with verifyWebhookSignature from the SDK
• Revoke a key and confirm subsequent requests return 401
• Check X-RateLimit-* headers appear on provider endpoint responses

[drips-wave]

@jerrymusaga Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits