Get Block Query Engine Credentials

Per-client Polaris credentials for the "Connect Your Query Engine" modal.

Lazy-mints when the client has no Polaris credentials yet — the SQL editor calls this on load, before a Block request has ever run the provisioning step. Eligibility (Enterprise plan + Block role) is already enforced above, so a missing-creds call here is a legitimate first-time mint, not a leaked admin path.