feat: add admin accounts and image templates

lib/server/public-api-auth.ts

@@ -41,6 +41,11 @@ export function authenticatePublicApiRequest(request: Request): PublicApiClient
   return client;
 }
 
+export function publicApiOwnerId(client: PublicApiClient | string): string {
+  const id = typeof client === "string" ? client : client.id;
+  return `api:${sanitizeOwnerPart(id)}`;
+}
+
 export function assertInternalWorkerToken(request: Request) {
   const expected = process.env.ZHINIAN_INTERNAL_WORKER_TOKEN?.trim();
   if (!expected && process.env.NODE_ENV !== "production") return;
@@ -67,3 +72,7 @@ function safeEqual(expected: string, presented: string): boolean {
   if (left.length !== right.length) return false;
   return timingSafeEqual(left, right);
 }
+
+function sanitizeOwnerPart(value: string): string {
+  return value.replace(/[^A-Za-z0-9_.:@-]+/g, "_").slice(0, 96) || "unknown";
+}