Issue an API key

Mints a key brain verifies itself, returning the plaintext ONCE — it is stored only as a SHA-256 hash and cannot be recovered. The granted scopes are the requested ones intersected with what the calling credential already holds, so a key is never wider than its issuer; asking for none that the caller holds is 403. Only the four delegable scopes are accepted (brain:read, brain:write, brain:admin, brain:read_pii) — operator scopes are not mintable. A user-bound caller can only bind the key to itself. Tenants are capped at 25 live keys.

Required scope: brain:read.