Create Api Key

Raw key is generated here, shown ONCE in this response, and never stored or retrievable again -- only its SHA-256 hash is persisted, same pattern as the webhook secret above. A business can hold multiple active keys at once (e.g. one per environment); creating a new one does not revoke any existing key.