Create Api Key

Create a self-hosted API key (agent/machine credential) for the signed-in user. Requires a verified Firebase ID token (human self-serve path) — any authenticated account may mint one, including the free tier: a free key resolves to the public tier and is REFUSED on every programmatic surface by the Dev-gate (2026-09-10 — free keys can no longer draw the 20-credit browser pool; the key is the Dev-funnel entry point, and its first call shows the upgrade hint). Returns the plaintext key EXACTLY ONCE — it is stored only as a SHA-256 hash, so the caller must persist it now (the response is the only copy). That makes this body a secret: it is declared in the edge cache tooling's MUST_NOT_BE_CACHED, so no cache rule may ever cover this path.