Issue a new API key for an existing org. Firebase-authed.
Scope rules:
scope_type="workspace": caller must have role >= editor in the
org (viewers are blocked explicitly). The key inherits the caller’s
current role at request time; if their role is later downgraded,
the key’s authority shrinks with it.scope_type="personal": the key is tied to the caller as an
individual. No org-role gate. org_id is still stored on the
record for audit.