API keys

Mint ak_-prefixed bearer tokens so integrators can call /api.ashx/v1/… without sharing an admin OIDC token. The raw key is shown once on creation — copy it then. Stored as a SHA-256 hash on disk; revoke any key at any time without affecting the others. See api-docs.html for the endpoint surface.