Redeem an owner-issued issuance token for an API key

Agent-side half of headless key issuance — the first Apier endpoint a cold agent can call that ends with it holding its own API key, with no browser and no inbox. Zero-auth by definition: the presented one-time token IS the credential, and it only exists because the human account owner minted it in the dashboard — agents cannot self-issue. Redemption is strictly single-use and ATOMIC: one SECURITY DEFINER transaction consumes the token (compare-and-swap UPDATE … RETURNING), mints the key through the same canonical create_consumer_key RPC the dashboard uses (scopes ["read:*"], the account's existing max-3-active-keys cap enforced under its advisory lock), and backlinks the issued key onto the token row. Two concurrent redemptions of the same token therefore yield exactly one key. If the account already holds 3 active keys the whole transaction rolls back — the token is NOT consumed (409 MAX_KEYS_REACHED tells the agent to have the owner free a key slot, then retry with the SAME token). Every other failure — expired, already-used, revoked, or never-existed — returns ONE uniform 401 ISSUANCE_TOKEN_INVALID body that is byte-identical across all four cases: a probe learns nothing about why a guess failed, only that it failed. plaintext_key is returned EXACTLY ONCE in the 201 body (same shape as POST /api/v1/account/keys); the accepted terms version in force is stamped into the redemption audit event. Rate limits are three fail-safe layers on hourly windows: 5 attempts per hour per (IP, token) — keyed on the token's hash as well as the IP so a clean client's first attempt with a distinct token is never blocked by unrelated traffic on a shared egress IP — plus a per-IP wall of 30 attempts per hour across all tokens, both fail-CLOSED, plus a global hourly ceiling across all callers, fail-OPEN. A definitive over-limit returns 429 RATE_LIMITED with the store's actual remaining window in Retry-After; a rate-limit-store failure returns an honest retryable 503 RATE_LIMIT_CHECK_UNAVAILABLE (Retry-After: 30) instead of a fake limit verdict — nothing is redeemed or counted in either case.