fix: resolve CI failures after merging main

- Migration: rebase dataset_id migration onto current head (d2f1a4b8c3e0)
  instead of 7bad07dc267d, which had become a second head after upstream
  merged 0b2f2c8a9d1e; restores a single Alembic head.
- Integration test: capture dataset ids into locals before the commit that
  expires the instances, fixing a DetachedInstanceError in
  test_list_excludes_keys_bound_to_other_datasets.
- Web test: add the new useDatasetScopedApiKeys export to the use-dataset mock
  in api-key-management-flow.test.tsx (SecretKeyModal now calls it).

api/migrations/versions/2026_06_17_0900-e4f8a2c61d35_add_dataset_id_to_api_tokens.py

@@ -1,8 +1,8 @@
 """add dataset_id to api_tokens
 
 Revision ID: e4f8a2c61d35
-Revises: 7bad07dc267d
-Create Date: 2026-06-10 09:00:00.000000
+Revises: d2f1a4b8c3e0
+Create Date: 2026-06-17 09:00:00.000000
 
 Reintroduces the nullable `dataset_id` column on `api_tokens` (it was dropped in
 2e9819ca5b28 when dataset keys became tenant-scoped) to support API keys bound to
@@ -23,7 +23,7 @@ import models as models
 
 # revision identifiers, used by Alembic.
 revision = "e4f8a2c61d35"
-down_revision = "7bad07dc267d"
+down_revision = "d2f1a4b8c3e0"
 branch_labels = None
 depends_on = None
 

api/tests/test_containers_integration_tests/controllers/console/test_apikey.py

@@ -261,6 +261,10 @@ class TestDatasetApiKeyListResource:
         db_session_with_containers: Session,
     ) -> None:
         client, headers, dataset = setup_dataset
+        # Capture ids up front: the commit below expires these instances and the
+        # subsequent request teardown detaches them, so reading dataset.id afterwards
+        # would raise DetachedInstanceError.
+        dataset_id = dataset.id
         other_dataset = Dataset(
             tenant_id=dataset.tenant_id,
             name=f"Other Dataset {uuid4()}",
@@ -272,11 +276,12 @@ class TestDatasetApiKeyListResource:
         )
         db_session_with_containers.add(other_dataset)
         db_session_with_containers.commit()
+        other_dataset_id = other_dataset.id
 
-        other_resp = client.post(f"/console/api/datasets/{other_dataset.id}/api-keys", headers=headers)
+        other_resp = client.post(f"/console/api/datasets/{other_dataset_id}/api-keys", headers=headers)
         assert other_resp.status_code == 201
 
-        resp = client.get(f"/console/api/datasets/{dataset.id}/api-keys", headers=headers)
+        resp = client.get(f"/console/api/datasets/{dataset_id}/api-keys", headers=headers)
 
         assert resp.status_code == 200
         assert resp.json is not None

web/__tests__/develop/api-key-management-flow.test.tsx

@@ -69,6 +69,7 @@ vi.mock('@/service/use-apps', () => ({
 
 vi.mock('@/service/knowledge/use-dataset', () => ({
   useDatasetApiKeys: () => ({ data: null, isLoading: false }),
+  useDatasetScopedApiKeys: () => ({ data: null, isLoading: false }),
   useInvalidateDatasetApiKeys: () => vi.fn(),
 }))