Create an API key, optionally restricted, scoped to one workspace or one computer, or expiring

A key never makes or changes a key into more than it has itself: every group at or under its own level, its scope inside its own (a workspace key makes keys only for that workspace, never one for every workspace), and an expiry no later than its own when it expires. It changes or revokes only keys already within its own access, and only narrows itself; anything past that is 403 key_escalation. A signed in session may do anything to its own keys. A computer’s own key manages no keys (403 computer_key), nor does a key for one computer (403 computer_scope). An expired key answers 401 key_expired. The value is returned once. Sending neither permissions nor an expiry makes a full access key that never expires, as before. computer_id makes a key for one Linux computer (where enabled): it calls only that computer’s control and lifecycle endpoints (start, stop, restart, suspend, resume; never delete, resize, clone, fork or move), its computer never changes, it is deleted with the computer and does not follow copies. Only a session or a key for the whole account makes one. Revoking one that could control the computer changes the computer’s VNC password.