Create Admin Api Key

Mint a new API key for the calling admin.

Returns the cleartext token in the response body. The caller must persist it: a re-read of the row will only expose the prefix.

Refuses with 409 when the calling admin already has the per-admin cap of active (un-revoked) keys. The actionable response is "revoke an old key, then mint again", surfaced in the error detail so a CLI client can show it verbatim. Revoked keys do not count toward the cap.