List and query service accounts in the active scope

Returns the machine identities (service accounts) visible in the active tenant/subscription/project scope, as rendered by the Service accounts page on route load. Each row carries the email-style identifier (<name>@iam. followed by the platform's DNS domain), ARN, key/binding counts, key-hygiene signal (oldestKeyAgeDays vs the 90-day rotation guideline) and 24h auth/denied counters. This single endpoint also serves the UI's search/filter/sort/pagination controls (collapsed iam.service_account.search_filter_sort): free-text q matches name or email; status narrows to enabled/disabled; staleKeys=true returns only accounts whose oldest key exceeds the 90-day rotation guideline; sortable columns include name, bindings, keys, lastUsed. Validation: scopeId must reference a scope the caller can access (unknown → 404 NOT_FOUND); status must be one of enabled|disabled and page/pageSize must be positive integers (else 422 VALIDATION_FAILED); caller needs at least reader on IAM in the scope (else 403 FORBIDDEN). Async & state: Synchronous read; no state change. Backed by the IAM read model; no SSE frames emitted. Errors: 401 missing/expired session; 403 caller lacks IAM read permission in the scope; 404 scope not found or not visible; 422 malformed query parameters; 500 read-model unavailable. Idempotency/Concurrency: Safe, cacheable; no idempotency key required.