Create a new API key for the authenticated user.

The full key value is returned only once in the creation response and cannot be retrieved again afterwards.

expires_at is required:

• A future datetime expires the key at that time.
• null creates a key that never expires.

Workspace scoping (optional): include scopes — a list of {workspace_id, permission} entries — to restrict the key to those workspaces. Each entry's permission is one of viewer, editor, or owner, and cannot exceed the role you currently hold on that workspace. Different scopes on the same key can carry different permissions.