Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/admin/dashboard/static/js/modules/auth-keys.js`:
- Around line 66-71: The copyAuthKeyValue method currently calls
navigator.clipboard.writeText(this.authKeyIssuedValue) without handling
rejection or absence of the Clipboard API; update copyAuthKeyValue to first
feature-detect navigator.clipboard and, if available, call
writeText(...).then(...) and add a .catch(...) to handle failures (set a new
error flag like this.authKeyCopyError = true, reset authKeyCopied appropriately,
and optionally console.error). If navigator.clipboard is not available,
implement a synchronous fallback that creates a temporary textarea, selects its
content and uses document.execCommand('copy') with try/catch to set
authKeyCopied or authKeyCopyError accordingly; ensure you clear the temporary
element and reset flags after 2s as existing logic does.

In `@internal/auditlog/middleware.go`:
- Around line 391-402: EnrichEntryWithAuthMethod currently assigns any string to
LogEntry.AuthMethod; update the EnrichEntryWithAuthMethod function to first trim
whitespace from the incoming method string, return early if the trimmed value is
empty, and validate it against a small allowlist of acceptable auth method
identifiers (e.g., "password", "oauth", "sso", "api_key", "magic_link",
"unknown"); only set entry.AuthMethod when the trimmed value is one of those
allowed values and keep existing nil-checks for c.Get(string(LogEntryKey)) and
type-assertion to *LogEntry as currently done.

In `@internal/auditlog/store_postgresql.go`:
- Around line 88-91: The migration slice in
internal/auditlog/store_postgresql.go contains a duplicated SQL entry "ALTER
TABLE audit_logs ADD COLUMN IF NOT EXISTS auth_method TEXT"; locate the
migrations array (the slice of ALTER TABLE statements) and remove the duplicate
entry so each column migration appears only once (ensure "user_path" and a
single "auth_method" remain), updating the migrations slice where those ALTER
TABLE strings are defined.

In `@internal/auditlog/store_sqlite.go`:
- Around line 73-76: Remove the duplicate "ALTER TABLE audit_logs ADD COLUMN
auth_method TEXT" entry from the migrations list so the migrations slice only
contains one addition of auth_method; edit the migrations variable (the
slice/array that includes "ALTER TABLE audit_logs ADD COLUMN auth_method TEXT",
"ALTER TABLE audit_logs ADD COLUMN user_path TEXT", etc.) and delete the
repeated auth_method string to keep the migration entries unique.

---

Outside diff comments:
In `@internal/server/auth.go`:
- Around line 74-85: Before calling authenticator.Authenticate, set the audit
method to AuthMethodAPIKey so failed managed-key attempts are attributed;
specifically, move or add the call to auditlog.EnrichEntryWithAuthMethod(c,
auditlog.AuthMethodAPIKey) to occur before invoking authenticator.Authenticate
(in the block guarded by authenticator != nil && authenticator.Enabled()), so
that authenticationErrorWithAudit and authFailureMessage will include the method
even on failure while leaving existing ctx/authKeyID handling unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/admin/dashboard/static/js/modules/auth-keys.js`:
- Around line 37-40: When handleFetchResponse(res, 'auth keys') returns false,
we should surface the HTTP failure instead of silently clearing the list: in the
failure branch in auth-keys.js (the block that currently sets this.authKeys = []
and returns) set the component/state variable authKeyError (or assign an error
message from the response) to indicate a load failure and do not clobber
authKeys; use handleFetchResponse and the response object to distinguish a 401
vs other errors so only 401 handling remains unchanged and all other non-2xx
responses set authKeyError (and early-return) rather than clearing the table.

In `@internal/admin/dashboard/templates/index.html`:
- Around line 238-240: The template buttons currently call openAuthKeyForm() and
can trigger clearing of the one-time authKeyIssuedValue while the key is
visible; update the logic in
internal/admin/dashboard/static/js/modules/auth-keys.js so openAuthKeyForm() and
closeAuthKeyForm() do not unconditionally clear authKeyIssuedValue — add checks
for a submission-in-flight flag (e.g., isIssuing) and whether the editor is
already open (e.g., isAuthEditorOpen) before clearing, set/clear that isIssuing
flag around submitAuthKeyForm() so submitAuthKeyForm() will set
authKeyIssuedValue and ensure it reopens the editor (set isAuthEditorOpen) if
the request completes after a manual close; also guard the template buttons (the
Create API Key and the other control mentioned) to not call openAuthKeyForm()
when isIssuing is true to avoid losing the only visible key.
- Around line 362-364: The empty-state paragraph currently shows "No API keys
yet" even when an authKeyError exists; update its x-show condition to also
require that authKeyError is falsy so it only renders when there is no load
error (i.e., change the condition on the <p class="empty-state"> that references
authKeys, authKeysLoading, authError, and authKeysAvailable to also include
!authKeyError) to prevent the empty message appearing alongside real error
messages.

In `@internal/auditlog/middleware_auth_method_test.go`:
- Around line 11-47: Add assertions for the remaining allowed auth-method values
in the existing tests: call EnrichEntryWithAuthMethod(c, "no_key") and assert
entry.AuthMethod == AuthMethodNoKey, and call EnrichEntryWithAuthMethod(c,
"unknown") and assert entry.AuthMethod == "unknown" (or the corresponding
constant if defined), keeping the same context setup (echo.New,
httptest.NewRequest, c.Set(string(LogEntryKey), entry)) and trimming/validation
expectations used with EnrichEntryWithAuthMethod so the test suite covers all
permitted values.

---

Outside diff comments:
In `@internal/server/auth.go`:
- Around line 43-52: When a request matches the skipPaths branch the middleware
returns early without setting AuthMethod, leaving audit records with an empty
auth method; update the skipPaths handling (the loop that checks skipPaths and
requestPath and currently does "return next(c)") to set the audit/auth indicator
(e.g. set AuthMethod = AuthMethodNoKey or the string "skipped" in the same
context/storage you use elsewhere) immediately before returning, so skipped
routes produce a consistent auth method value.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/admin/dashboard/static/js/modules/auth-keys.js`:
- Around line 233-273: The deactivateAuthKey method directly calls
window.confirm which breaks the module's testability; change that call to use
the injected global.confirm (or the module's injected confirm reference) instead
of window.confirm so tests can mock it; update the conditional at the start of
deactivateAuthKey to call global.confirm('Deactivate key "' + key.name + '"?
This cannot be undone.') and leave all other logic (authKeyDeactivatingID,
authKeyError, fetchAuthKeys, etc.) unchanged.