refactor(llc): consolidate duplicated key-validation, API-key placeholder, and terminal-status checks #9777

LLC DRY / consolidation cleanup

Three related duplications in the LLC module, surfaced while implementing the heartbeat run-scoped key lifecycle (#9622/#9623, PR #9772). None are bugs today, but each is a "edit-two-places-in-sync" hazard.

1. Agent-auth middleware reimplements ApiKeyService.validate_key (highest value)

llc/middleware/agent_auth.py hand-rolls the same key-validation query as ApiKeyService.validate_key — key_hash + revoked_at IS NULL + (now) expires_at TTL check — plus an inline hashlib.sha256(...) duplicating services/api_key.py._hash_key.

Note: PR #9772 had to add the expires_at clause to both places to keep them consistent — direct evidence of the hazard (miss one → expired keys accepted = security hole).

Fix: middleware calls ApiKeyService().validate_key(session, raw_key); keep the last_used_at update + request.state wiring in the middleware. Share _hash_key. Add middleware tests (none exist today) before/with the refactor.

2. "<injected-at-runtime>" placeholder duplicated

Defined as _AGENT_API_KEY_PLACEHOLDER in llc/adapters/claude_code_adapter.py but also written as a raw literal in llc/kb/context_builder.py (×2). The adapter skips this exact string when injecting AUTOBOT_LLC_API_KEY — if the builder's literal drifts, the real key leaks/placeholder leaks.

Fix: single shared constant (e.g. llc/config), imported by both.

3. No terminal-status helper on LLCRunStatus

LLCRunStatus (llc/models/enums.py) has no terminal/nonterminal helper. The concept is re-derived ad hoc:

• llc/scheduler/heartbeat_scheduler.py: _NONTERMINAL_STATUSES = {QUEUED, RUNNING}
• llc/adapters/copilot_subscription_adapter.py:162 and claude_code_subscription_adapter.py:183: in (LLCRunStatus.COMPLETED, LLCRunStatus.FAILED)

Fix: add LLCRunStatus.is_terminal() (or TERMINAL / NONTERMINAL frozensets) on the enum and replace the scattered checks.

References

Discovered during #9622/#9623 (PR #9772). Related dead-module cleanup: #9776.

Labels: enhancement · backend · priority: low