Rename a Key, Edit Origins, Budget or Scope

Rename a key, rewrite the origin list of a publishable key, set a per-key credit budget, limit the key to a subset of endpoints, or any combination. The class is fixed at creation: a pk_ key cannot become server-only, and a secret key cannot be given a list, so either request is refused with 400 rather than quietly rewritten. A new list takes effect at once and the key string does not change. credits_cap_cycle caps what this one key may spend per billing cycle, which credits alone do not, since they pool across the account; null clears it and a call over the cap answers 429 KEY_BUDGET_EXHAUSTED without falling through to overage. allowed_endpoints takes paths under /v1, exact ("chart") or a namespace ("embed/*"); null removes the limit and a call outside the list answers 403 ENDPOINT_NOT_IN_SCOPE. On a publishable pk_ key neither bound can be cleared: null for either is refused with 400.