Retrieve a key pair detail read model

Retrieves the full detail read model for one key pair, backing the key pair detail page on route load. The payload carries everything the Overview, Instances and Activity tabs render: id, name, algorithm (type) and key size (bits), SHA256 fingerprint, key comment, createdAt, the complete OpenSSH publicKey blob (shown with copy/download affordances and authorized_keys usage snippets), plus the usedBy instance references (id, name, status) that drive the Instances tab and the in-use deletion guard. The private key is never part of this response — it is revealed exactly once at creation and is not stored by the platform. Validation: scopeId must be accessible to the caller and keyPairId must identify a key pair within that scope — an unknown or out-of-scope id maps to 404 NOT_FOUND; no body or query inputs. Async & state: Synchronous read; no state change. Subsequent changes to the key pair (e.g. an instance attaching or detaching the key) arrive as resource.updated SSE frames of kind compute.keyPair with a JSON-merge patch of the changed fields. Errors: 401 unauthenticated; 403 caller lacks a read-capable role (owner|admin|contributor|reader) on the scope; 404 unknown scopeId or keyPairId; 500 read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response carries no ETag; the delete does not check If-Match.