fix(auth): hold scoped keys and lower roles to what they were granted - #2562

🟢 Confidence 10/10 · safe to merge. Scope and role plumbing is the risk here; each of the five gates is pinned by a test that fails without it.
_{no findings · tests covered · risk high}

Five authorization narrowings: scoped keys must hold a write scope to read monitor secrets or AWS setup, device keys can no longer be minted or used via MCP, Security Center telemetry needs security:manage, and demotion expires pending CLI/MCP approvals made above the new role.

• canWriteMonitors now also requires the key's uptime_monitors:write scope
• AWS setup requires integrations:write for scoped keys
• V2ApiKeyCreateParams.kind accepts only standard and mcp
• securityTenant gates the exposure and runtime tabs on security:manage

_{c892660 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}