Provision

Idempotent onboarding: create org if absent; issue first key if absent. Plaintext is also re-revealable later via GET /v1/account (at-rest encrypted; dashboard full-key copy).