Create Api Key

Mint a scoped API key for the signed-in tenant.

Two shapes:

• {"name", "role"} (no scopes) — today's behaviour: admin mints TENANT_ADMIN_SCOPES, agent and read_only their bounded role defaults. role defaults to admin.
• {"name", "scopes": [...]} — a NARROW key carrying exactly the named scopes (e.g. the analyst's submit key: ["disposition:write", "disposition:read"]). The list must be non-empty, in the vocabulary, and a subset of TENANT_ADMIN_SCOPES; otherwise 400 naming the refused scopes and nothing is minted. role defaults to agent (it only sets the key prefix; the stored scopes are the explicit list, which the resolver never widens). The response is unchanged: {api_key (show-once), key_id, role, scopes, expires_at}.