Redeem a PKCE key grant for an API key

Trades the one-time code from GET /auth/key plus the code_verifier the console kept for a freshly minted API key. Deliberately unauthenticated: possession of the verifier is the proof, which is what lets the key be minted without the console ever holding a session token for the person who approved it. Returns the plaintext key exactly once, in data.key. The code is consumed atomically before the verifier is checked, so a wrong verifier burns the code rather than leaving it up for another guess.