Get Current User

Identity + envelope for the calling admin API key.

Intentionally bypasses require_admin_permission: any valid, non- expired, non-disabled admin API key whose owner is still ADMIN/MANAGER can call this. Returning the resolved permission envelope is what makes a freshly-minted scoped key able to discover what it can do.