Issue one credential to read this project's event cursor.

Private, no-store and no CORS grant. The optional project event reader must be configured. Installation tokens and wide API keys cannot manage readers. Requires recent authentication, CSRF and exact empty JSON. Return the secret once. Store it privately with mode 0600. At most three active readers per project. The mmq_ credential expires after 30 days and only permits GET /api/monitor/projetos/:projeto/eventos. It cannot ingest, approve, buy or issue credentials. A timeout can leave an issued reader without its secret; list and revoke it before another issuance. Returns: { esquema, consulta, projeto, token, expira_em }