fix(MULTIPLA-004): CU-86akhf8u5 2 review findings across 2 files

[flamingo]

Closes 2 review findings across 2 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 65 medium	use-api-keys.ts hook does not use TanStack Query at all — plain useState/useCallback with manual fetch orchestration	src/app/(app)/settings/hooks/use-api-keys.ts:20
2	🟡 80 medium	useApiKeys.fetchApiKeys/createApiKey use a relative path without leading slash unlike all other apiClient calls	src/app/(app)/settings/hooks/use-api-keys.ts:29

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: c69bf2d8-6eaa-4e2d-815b-af08b880c8df

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akhf8u5 OpenFrame OSS frontend review findings sweep (12 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff.

[flamingo]

🦩 🔴 use-api-keys.ts hook does not use TanStack Query at all — plain useState/useCallback with manual fetch orchestration

Rewrote useApiKeys in src/app/(app)/settings/hooks/use-api-keys.ts to use TanStack Query's useQuery (for the list, keyed via new shared adminQueryKeys.apiKeys.list()) and useMutation for create/update/regenerate/enable-toggle operations, each with onSuccess calling queryClient.invalidateQueries({ queryKey: adminQueryKeys.apiKeys.all }). Added new shared module src/app/(app)/settings/hooks/admin-query-keys.ts exporting adminQueryKeys with structured keys, since none existed in the file set provided. The public return shape (items, isLoading, error, fetchApiKeys, createApiKey, updateApiKey, regenerateApiKey, setApiKeyEnabled) is preserved so existing consumers keep working without changes, with fetchApiKeys now wrapping refetch(). Risk: I could not see use-users.ts to confirm exact naming/shape conventions for adminQueryKeys, so the key structure is a reasonable but unverified guess; a complete fix should align this module's naming with whatever convention use-users.ts actually uses.

🤖 Prompt for AI agents

In src/app/(app)/settings/hooks/use-api-keys.ts around line 20, review and complete this code-review fix: use-api-keys.ts hook does not use TanStack Query at all — plain useState/useCallback with manual fetch orchestration.
What the draft fix changed: Rewrote `useApiKeys` in `src/app/(app)/settings/hooks/use-api-keys.ts` to use TanStack Query's `useQuery` (for the list, keyed via new shared `adminQueryKeys.apiKeys.list()`) and `useMutation` for create/update/regenerate/enable-toggle operations, each with `onSuccess` calling `queryClient.invalidateQueries({ queryKey: adminQueryKeys.apiKeys.all })`. Added new shared module `src/app/(app)/settings/hooks/admin-query-keys.ts` exporting `adminQueryKeys` with structured keys, since none existed in the file set provided. The public return shape (`items`, `isLoading`, `error`, `fetchApiKeys`, `createApiKey`, `updateApiKey`, `regenerateApiKey`, `setApiKeyEnabled`) is preserved so existing consumers keep working without changes, with `fetchApiKeys` now wrapping `refetch()`. Risk: I could not see `use-users.ts` to confirm exact naming/shape conventions for `adminQueryKeys`, so the key structure is a reasonable but unverified guess; a complete fix should align this module's naming with whatever convention `use-users.ts` actually uses.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 65 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 useApiKeys.fetchApiKeys/createApiKey use a relative path without leading slash unlike all other apiClient calls

Added leading slashes to all apiClient calls in the same file (/api/api-keys, /api/api-keys/${id}, /api/api-keys/${id}/regenerate) to match the use-users.ts convention cited in the finding, fixing the inconsistency directly in the queryFn/mutation functions of useApiKeys.

🤖 Prompt for AI agents

In src/app/(app)/settings/hooks/use-api-keys.ts around line 29, review and complete this code-review fix: useApiKeys.fetchApiKeys/createApiKey use a relative path without leading slash unlike all other apiClient calls.
What the draft fix changed: Added leading slashes to all `apiClient` calls in the same file (`/api/api-keys`, `/api/api-keys/${id}`, `/api/api-keys/${id}/regenerate`) to match the `use-users.ts` convention cited in the finding, fixing the inconsistency directly in the `queryFn`/mutation functions of `useApiKeys`.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 80 medium — react 👍/👎 to teach the reviewer

[michaelassraf]

Task linked: CU-86akhf8u5 OpenFrame OSS frontend review findings sweep (12 PRs)