fix(rotation): adapt phase-1 to main after rebase

Two changes required by main moving forward (PRs #127, #134, #137):

1. internal/api/server_test.go was added in PR #127 (remote console)
   after Phase 1 branched. It uses the old ServerConfig.APIKey field
   that Phase 1 replaced with KeyRing. Updated the test to construct
   a one-entry KeyRing and send the legacy 64-hex bearer token.

2. PR #127 also added migration 000002_add_box_console_enabled,
   colliding with Phase 1's 000002_add_box_agent_keys. Renumbered
   Phase 1's migration to 000003. Migrations are content-addressed
   by the embedded iofs, so the rename is mechanical — no schema
   change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox-agent/internal/api/server_test.go

@@ -1,12 +1,15 @@
 package api
 
 import (
+	"encoding/hex"
 	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
+	"github.com/sarg3nt/gearbox-agent/internal/framework/crypto"
 	"github.com/sarg3nt/gearbox-agent/internal/framework/events"
 )
 
@@ -29,9 +32,21 @@ func TestNewServer_ConsoleRoutesAlwaysMounted(t *testing.T) {
 	bus := events.NewBus()
 	defer bus.Close()
 
+	// Build a one-entry keyring whose legacy bare-hex token the test
+	// then sends in the Authorization header. The keyring replaced the
+	// single-string APIKey field on ServerConfig (issue #72).
+	testSecret := strings.Repeat("ab", 32) // 64 hex chars / 32 bytes
+	secretBytes, _ := hex.DecodeString(testSecret)
+	kr := &crypto.KeyRing{
+		Version: 1,
+		Entries: []crypto.KeyRingEntry{{
+			KID: "legacy", Secret: secretBytes, SecretHex: testSecret, Role: "primary",
+		}},
+	}
+
 	srv := NewServer(ServerConfig{
 		ListenAddr: "127.0.0.1:0",
-		APIKey:     "test-key",
+		KeyRing:    crypto.NewKeyRingPointer(kr),
 		Logger:     newSilentLogger(),
 		EventBus:   bus,
 	})
@@ -42,7 +57,7 @@ func TestNewServer_ConsoleRoutesAlwaysMounted(t *testing.T) {
 	// Capabilities — auth-gated, no token required, deterministic
 	// response.
 	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/api/v1/console/capabilities", nil)
-	req.Header.Set("Authorization", "Bearer test-key")
+	req.Header.Set("Authorization", "Bearer "+testSecret)
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatalf("capabilities request: %v", err)