List API keys

Key metadata only (prefix, label, last_used, and the scope record when the key has one) — never secrets. A key with no scopes field resolves to LEGACY_DEFAULT.

Requires the keys:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying keys:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include keys:read — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).