Export key pair material as a downloadable PEM artifact

Produces a downloadable PEM artifact for the selected key pair, backing the "Download .pem" button shown in the key pair creation form. The exportable artifact is the public key material (artifact: public-key-pem), returned inline as a KeyPairExport with the suggested fileName, contentType and PEM content. Private key material is NOT exportable through this endpoint: the private key is revealed exactly once in the create response (the UI downloads it client-side at generation time) and is never persisted by the platform, so artifact: private-key-pem is always rejected. Validation: scopeId must be accessible to the caller (404 when unknown); keyPairId must identify a key pair within that scope (404 NOT_FOUND); artifact must be one of public-key-pem | private-key-pem (422 VALIDATION_FAILED on unknown values); requests for private-key-pem map to 409 CONFLICT because the material is not retained server-side. Async & state: Synchronous command returning 200 with the export payload; requested data is returned without mutating the resource and no SSE frames are emitted. Errors: 401 unauthenticated; 403 caller lacks a read-capable role (owner|admin|contributor|reader) on the scope; 404 unknown scopeId/keyPairId; 409 private key material requested but not retained; 422 unknown artifact; 500 export rendering failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. The export is derived purely from stored public material, so repeated calls return the identical payload and are inherently safe.