Create toolkit

Create a toolkit and issue its first API key.

The plaintext key (jntc_live_…) is returned once in api_key and is never retrievable again. Optional credential_ids bind existing credentials at creation time; each inline bind emits a no_permission_rules warning because the broker denies by default until rules are added.