Create (generate) or import an SSH key pair in the active scope

Creates a key pair in the active scope. Two UI entry points collapse here: the the key pair creation form submission and the "Create key pair" button on the Key pairs page (which opens the same form; "Import key" opens it pre-set to import mode). The form captures the region (read-only, scope-derived), the key pair name, the key type (ssh for ED25519/RSA over SSH on Linux, x509 certificates for Windows / mTLS), and the source: generate asks the platform to create the key material, import registers a public key the caller already owns (only the public key is uploaded — the private key never leaves the client). On success the key pair becomes discoverable in the scoped list. Validation: name must match ^[a-z0-9][a-z0-9-]{0,62}$ (lowercase letters, digits, hyphens, up to 63 chars — 422 VALIDATION_FAILED otherwise) and be unique within the region (409 CONFLICT on duplicates); keyType must be ssh or x509; source must be generate or import; when source=import, publicKey is required and must be a valid OpenSSH public key (ssh-ed25519 / ssh-rsa / ecdsa-… prefix) unless keyType=x509 (422 otherwise); scopeId must be accessible (404 when unknown). Async & state: Synchronous create returning 201 with the full KeyPairCreated resource. For source=generate the response includes privateKeyPem — the ONLY time the private key is ever returned; it is not stored by the platform and cannot be retrieved later (the UI forces a download of the .pem before leaving the page). For source=import, privateKeyPem is null. The new key pair is announced via a resource.updated SSE frame of kind compute.keyPair. Errors: 401 unauthenticated; 403 caller lacks a write-capable role (owner|admin|contributor) on the scope; 404 unknown scopeId; 409 duplicate name in the region; 422 invalid name/keyType/source/publicKey; 500 key-generation or persistence failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended); replaying the same key returns the original 201 response — including the same privateKeyPem — instead of generating a second key pair, so a UI retry cannot silently mint divergent key material.