List the authenticated user's API keys

Lists every API key on the account, including the ones already expired (kept visible for auditing until the cleanup task removes them).

The secret is never returned. It is shown exactly once, when the key is created or when a client authorization is claimed — there is no endpoint that reads a secret back. prefix is the first 8 characters of the secret, for matching a key in the panel against a key in a CI log.

resources empty means the key reaches the whole account; expires_at null means it never expires (manual keys). last_used_at is best-effort: it is written outside MongoDB with a 30-day TTL, so a key unused for longer reports null.

Session token only — an API key cannot manage API keys, not even itself.