Confirm a key authenticates and return the workspace it belongs to. Records verification, not usage.

Requires no scope — any valid key can verify itself. Stamps api_keys.verified_at and emits mcp_connection_verified; deliberately does NOT touch last_used_at or emit api_call, so checking a key can never make it look like an agent used it. Prefer this over calling a data endpoint to test credentials.