Copy an app into a new private app owned by the caller

Creates the caller a private copy of an app they can edit, or of a Template they may copy, without sending its source. A Template copy records the source as its origin (copyKind: "template"). The copy keeps the source code, styles, icon, and network settings; it never carries sharing, Public, signed-in access, Template or Listed state, tokens, secrets, Routines, Webhooks, custom domains, or version history. Without manifest_id the copy takes the next free manifest id after the source's (<id>-2, <id>-3); a manifest_id the caller already holds is refused with 409 rather than replacing that app. include_data: true also copies the stored data and assets in the same transaction that creates the copy, so a copy exists with all of its data or not at all; it needs owner access to a personally owned source (a team app's data is not copied into a personal account), and the data must fit the 24 MiB a copy carries, the per-app caps, and the caller's storage allowance. Without idempotency_key every call creates a new copy and answers 200 with it; a retry with the same key answers with the copy, or the pending build, the first call made, and the same key with a different source, include_data, or manifest_id answers 409 idempotency_conflict. A 409 manifest_id_conflict names the app holding the id in existingAppId when one does. An ESM app copies through a build; a build that does not publish at once answers 202 with its build status, and the data copies when it publishes. secretsNotCopied names the source secrets to set on the copy; it is reported only to callers who can manage the source's secrets.