Store a new random secret under a new key, and return nothing.

The value is secrets.token_urlsafe(32), 256 bits, the routes/passwords.py precedent. Create-only: a key that already has a row in that scope answers 409, so a generate never replaces a value the app depends on. The response carries no value; the console's audited reveal is the read path.