Start a PKCE key grant (browser flow)

Begins the flow that gives an OpenCompany console an API key without anyone copying one. The console sends a browser here with the hash of a secret it keeps (code_challenge); this runs the normal provider sign-in, shows a consent screen naming the requesting origin and the scopes, and on approval returns to callback_url with a one-time code. The console then trades that code plus the original secret for the key at POST /auth/keys. A grant carries the default set plus any scope named in scopes, within what a human could mint by hand. connections is the only scope absent from the defaults, so it is the only one scopes can add. mode=manual skips the callback round trip entirely: the flow ends on this backend's own dashboard, which shows the freshly minted key once for a person to copy — for an app that cannot host a callback, or anyone who would rather paste a key than trust a redirect. It needs no code_challenge (nothing is posted to callback_url, so there is no code in transit for a verifier to protect), but callback_url is still required and validated: it is what decides the grant's scopes and team. The dashboard then completes the grant with GET /auth/key/grant/{code} and POST /auth/key/grant/{code}/issue. The default, mode=code (or omitted), is the original exchange: code_challenge and code_challenge_method=S256 are both required, and the resulting code is redeemed at POST /auth/keys.