API keys

Scoped per app, per (optional) connection allowlist. Full key is shown once at creation; we only store an argon2id hash.

Mint a key to let a clrTech app start calling clrAI.