Create Connector Key

Get-or-create the per-user API key the remote MCP server (RS) uses to call core on behalf of a connector user. TWO proofs (like /keys/self-serve): the X-Admin-Key (caller = the trusted RS) AND the user's OIDC access token forwarded as X-Connector-Token (verified against the AS JWKS). The org is DERIVED from the verified sub (user_<sub>), never from the body — so this path may target the reserved user_ namespace WITHOUT weakening the POST /admin/keys guard.

Revokes any prior active connector key for this (user, client_label) and mints a fresh one (the raw key is only knowable at creation; the RS caches it). Invariant: at most one ACTIVE connector key per (user, client_label) — different clients (claude, chatgpt, ...) hold their own keys simultaneously; the NULL group (older RS builds) is matched via IS NOT DISTINCT FROM. All keys are tagged name="__connector__" so they never collide with the user's own portal keys.

Tier and limits come from the ORG SUBSCRIPTION, not the body: enforcement (DailyQuotaMiddleware in usage.py) reads limits from the KEY row, so connector traffic must carry the org plan rather than hardcoded free defaults. Keys rotate hourly, so later plan changes self-heal within an hour. The body's tier/limit fields are IGNORED (wire compat with older RS builds only).