Get service account detail with keys, bindings and auth activity

Retrieves the full service account detail read model for one service account in the active scope: the account profile (email, ARN, uniqueId, status, creator, key hygiene counters), its long-lived keys with age/expiry tracking, its role bindings (role, subscription or project scope, grantor, grant date) and the most recent authentication events (action, source IP, result, token type). Key entries expose only public metadata (fingerprint, dates, status) — private key material is never present in this response. Validation: scopeId must be accessible to the caller and serviceAccountId must reference an account visible in that scope (unknown or soft-deleted → 404 NOT_FOUND); caller needs IAM reader permission or better (else 403 FORBIDDEN). Async & state: Synchronous read; no state change. The detail view subscribes to resource.updated frames (kind: iam.service_account) for live status refreshes but this endpoint itself emits nothing. Errors: 401 unauthenticated; 403 caller lacks IAM read permission; 404 scope or service account not found; 500 read-model unavailable. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response carries no ETag; its mutations do not check If-Match.