Mint a managed agent key

Called by the PLATFORM'S SERVER (the SDK's mintAgentKey / createAgentKeyRoute). ctx is the platform-signed user-context JWT — Bubblio checks WELL-FORMEDNESS ONLY (three dot-separated base64url segments) and can neither verify nor forge it (it stores only a hash of the API key the signing secret derives from). Custody rules: the raw bak_ key is returned ONCE and stored SHA-256; the ctx is encrypted at rest immediately and never logged.

max_active_per_user (#49) is the opt-in per-user active-key quota, enforced INSIDE the mint: a pre-check refuses the common at-cap case before any write, and the post-insert count is the race-proof enforcement — concurrent mints can fail CLOSED (a spurious 409 a retry resolves) but can never overshoot the cap, PROVIDED every concurrent mint for that user carries the cap (the SDK's createAgentKeyRoute stamps it on every mint, grant path included). An UNCAPPED rival mint commits outside the enforcement and is never rolled back, so mixing capped and uncapped mints for one user can exceed the number the capped ones asked for.