Mint an API key (session-only; plaintext returned once)

Body: { name, mode: live|test, kind: secret|public, allowedOrigins?, permission?, expiresAt? }. kind=public mints a publishable gf_pub_ key (read_only, needs ≥ 1 allowed origin; see the publicKey security scheme). When the email-verification flow is enabled, minting a live key requires a verified email (403 otherwise). Test keys are never gated. scopes (secret keys only) narrows the key to named areas (adresse, bbr, matrikel, dagi, dhm, stednavne, cvr, energimaerke, vurdering, plan, miljoe, luftfoto, eksport, overvaagning) and/or grants the account scopes usage and webhooks, which no key holds unless it names them. Omitted = every data area. Out-of-scope calls answer 403 key_scope.