Create activation key.

Creates one unassigned organization activation key and returns the raw key material exactly once. The backend stores only the key hash.

Requires system-admin permissions. The key is later exchanged by an authenticated user with an inactive personal organization.