Get Current User

Identity + envelope for the calling admin API key.

Intentionally bypasses require_admin_permission: any valid, non- expired, non-disabled admin API key whose owner is still ADMIN/MANAGER can call this. Returning the resolved permission envelope is what makes a freshly-minted scoped key able to discover what it can do — together with the key's own grants, since authorization is the AND of the two.