API keys

Keys are scoped to an organization, and organizations are governance work — Phase 3 in the PRD. The shape exists today (see Keys and webhooks, which reads real, seeded keys) but issuing your own is not available in this release: every route in this section is anonymous or session-based, and none accepts a key yet.