Mint a credential on this identity

Mints one more credential — a secret or an api_key — on an existing identity's OIDC client and returns it once. An identity holds at most one live credential of each kind, so minting a kind it already holds live at the provider is 409; revoke it first, or rotate it.

The credential is created at the provider first, then recorded here with a created audit event. An api_key records the credential_ttl_seconds it was minted with (also accepted as expires_in_seconds), and every later rotation re-applies it. If this identity's record still shows a live credential of the kind that the provider no longer has (it expired, or was revoked out of band), the provider accepts the mint and the stale record is retired beside the new one — the kind never wedges.

Manageable by the identity's owner or an account admin. The member who provisioned the identity may mint on it; an account admin (organization#clients_manage) may mint on anyone's. A platform identity (action, registry) and an artifact's identity are unreachable by anyone and answer 404. Runs as the calling operator — the caller's bearer is forwarded to the provider.