Create a Core protocol key for an Accounts-authorized workspace

Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Core uses its existing key generator and hash storage with fixed MEMBER decision:read/decision:write scopes. Only the first successful response discloses raw_key. No recoverable response ciphertext is stored. An authorized retry returns already_issued metadata; a lost first response requires explicit revocation and a new command.