Mint an API key and return its raw credential exactly once.

Costs nothing quota-wise. Store the response's key immediately because only its hash and display prefix persist. The account:write scope is owner-gated. Recover from key_limit_reached by revoking an unused key, from scope_missing with an owner-authorized key, and from rate_limited or service_unavailable by waiting retry_after_sec before retrying; never log the response credential.