List API credentials

Lists the credentials issued for the caller's own project and environment, oldest first, one page at a time. The authority tuple comes from the verified principal, so there is no parameter that could name another project — a listing is the caller's own book or nothing. Revoked and rotated credentials stay in the listing and carry the fields that say so; a credential nobody can see is a credential nobody can audit. limit is bounded by the contract and cursor is the opaque value the previous page returned. No page carries a secret: the item is the read shape, which has no field one could be put in.