Create the key for a manual grant and return it once

Spends the grant and mints its key, returning the plaintext in the response body — never in a redirect — so it reaches the page that asked for it without passing through a URL, a history entry, or a Referer. Authenticated by session rather than by a PKCE verifier: a manual grant has no verifier, and the proof it takes instead is that the caller is the signed-in person the grant was minted for.