Fix API key cleanup on user deactivation and build archive race condition

Delete all API keys created by a user when their account is disabled,
deleted, or soft-deleted. Store build archives before enqueuing to Redis
so workers never dequeue a build with missing files.

pkg/service/build.go

@@ -139,16 +139,16 @@ func (s *BuildService) Create(ctx context.Context, p BuildCreateParams) (db.Temp
 		return db.TemplateBuild{}, fmt.Errorf("insert build: %w", err)
 	}
 
-	// Enqueue build ID (as formatted string) to Redis for workers to pick up.
-	if err := s.Redis.RPush(ctx, buildQueueKey, buildIDStr).Err(); err != nil {
-		return db.TemplateBuild{}, fmt.Errorf("enqueue build: %w", err)
-	}
-
-	// Store archive for the worker if provided.
+	// Store archive before enqueue so the worker never dequeues without files.
 	if len(p.Archive) > 0 {
 		s.storeArchive(buildIDStr, p.Archive)
 	}
 
+	if err := s.Redis.RPush(ctx, buildQueueKey, buildIDStr).Err(); err != nil {
+		s.takeArchive(buildIDStr) // clean up on enqueue failure
+		return db.TemplateBuild{}, fmt.Errorf("enqueue build: %w", err)
+	}
+
 	return build, nil
 }