fix: complete audit security and frontend gaps

backend/internal/ai/gateway_test.go

@@ -3,6 +3,7 @@ package ai
 import (
 	"fmt"
 	"testing"
+	"time"
 
 	"github.com/glebarez/sqlite"
 	"github.com/stretchr/testify/require"
@@ -22,6 +23,21 @@ func TestSelectKeyPrefersUserKey(t *testing.T) {
 	require.Equal(t, "user-key", selected.APIKey)
 }
 
+func TestSaveUserKeyEncryptsStoredKey(t *testing.T) {
+	database := newTestDB(t)
+	gateway := NewGatewayWithSecret(database, "system-key", "test-encryption-secret")
+
+	require.NoError(t, gateway.SaveUserKey(3, "openai", "user-key"))
+
+	var stored domain.AIKey
+	require.NoError(t, database.Where("user_id = ?", 3).First(&stored).Error)
+	require.NotEqual(t, "user-key", stored.EncryptedAPIKey)
+	require.Contains(t, stored.EncryptedAPIKey, "v1:")
+	selected, err := gateway.SelectKey(3)
+	require.NoError(t, err)
+	require.Equal(t, "user-key", selected.APIKey)
+}
+
 func TestSelectKeyFallsBackToSystemKey(t *testing.T) {
 	database := newTestDB(t)
 	gateway := NewGateway(database, "system-key")
@@ -58,6 +74,16 @@ func TestRecordCallStoresAuditFields(t *testing.T) {
 	require.Equal(t, "rate limited", log.Error)
 }
 
+func TestCheckRateLimitRejectsCallsOverWindow(t *testing.T) {
+	database := newTestDB(t)
+	gateway := NewGateway(database, "system-key")
+	require.NoError(t, gateway.RecordCall(3, "openai", "system", "inbox_analyze", "succeeded", ""))
+
+	err := gateway.CheckRateLimit(3, "inbox_analyze", 1, time.Hour)
+
+	require.ErrorContains(t, err, "ai rate limit exceeded")
+}
+
 func TestCreateAISession(t *testing.T) {
 	database := newTestDB(t)
 	service := NewSessionService(database)