Create an OpenStack API credential (secret revealed once)

Mints a RESTRICTED, EXPIRING Keystone application credential for the caller (or, with serviceAccountId, for a service account) scoped to this project, usable with Terraform, the openstack CLI, OCCM and Cinder CSI. The owner's Keystone principal is created lazily; its project roles are derived from the portal permissions. The chosen profile (full = member + load-balancer_member, readonly = reader + load-balancer_observer) can never exceed that projection. Expiry is mandatory: default 90 days, at most 365. Limits: 20 active credentials per owner, 50 per project. The response carries applicationCredentialSecret exactly ONCE. It is never stored by the platform (not in the database, logs, audit or idempotency records) and cannot be retrieved again. Authorization: an interactive console session with a second factor verified in the last 5 minutes (pc_live_ tokens and sak_live_ keys are refused); direct API access enabled for the organisation and not locked by the platform operator (403 details.reason API_ACCESS_DISABLED_BY_OPERATOR); own credential: compute, network and storage at least read on the project; service-account credential: tokens: manage AND the caller's permissions on the project must dominate the service account's. Errors: 401; 403 (FORBIDDEN, MFA_STEP_UP_REQUIRED, MFA_SETUP_REQUIRED, INTERACTIVE_SESSION_REQUIRED); 404 scope or service account; 409 an Idempotency-Key that was already used (the secret is never replayed) or a limit reached (QUOTA_EXCEEDED); 412 API access disabled / project not provisioned; 422 validation; 429 RATE_LIMITED another credential of the same owner is being minted right now and did not finish within the wait (retry); 503 the cloud could not complete it (retry). Concurrent requests with one Idempotency-Key: exactly one mints, the others answer 409.