Mint a one-time key-issuance token for a headless agent

Owner-side half of headless key issuance. The signed-in account OWNER mints a single-use issuance token here, hands it to their AI agent out of band, and the agent redeems it — once, within 24 hours — at POST /api/v1/account/issuance-tokens/redeem for its own ["read:"]-scoped API key. The identity step is deliberately owner-issued, never agent-self-asserted: this surface requires a dashboard session cookie, so no Bearer key (and therefore no agent) can ever reach it. plaintext_token is returned EXACTLY ONCE in the 201 body; the server persists only its SHA-256 hash and cannot re-show it. Takes NO request body — token lifetime (24h) and the redeemed key's scope (["read:"]) are server-fixed, so there is no caller input to validate. At most 3 outstanding (unredeemed, unrevoked, unexpired) tokens may exist per account, enforced atomically under an advisory lock in the mint_key_issuance_token RPC (409 MAX_ISSUANCE_TOKENS_REACHED at the cap). Inline rate limit: 5 mints per hour per consumer, fail-CLOSED — an issuance surface narrows, never widens, on a rate-limit-store outage. Every mint writes an issuance_token.mint audit event.