Get a child API key
Returns a single child API key minted by the authenticated service key. Revoked keys ARE returned by this endpoint (with revoked_at populated) so callers can render “this key is revoked” state. Keys minted by a different service key in the same account return 404 (existence-leak protection, GitHub org-token convention).
