Create a new user-wide API key. The raw key is returned only once.
Generates an olk_{env}_{user_hex}_{random} plaintext via
generate_key. The plaintext is sent to the caller exactly once; the
server only stores key_hash (sha256) and key_prefix (first 16 chars).
Connection-scoped keys are issued separately via
POST /sandboxes/{id}/connections/{cid}/api-keys.