Service accounts and API keys

[GregorShear]

Summary

• Add service accounts management UI under a new Admin tab
• Flowctl access token route — new /flowctl/accessToken page with copy-to-clipboard button (token never displayed on screen), marked data-private for LogRocket
• CLI-API tab consolidation — moved refresh token and access token sections under Service Accounts; CLI-API tab now shows a redirect notice with link

Test plan

• Create a service account with each capability level (admin, read) and verify it appears in the table
• Create an API key, confirm the secret is shown once, copy it, close the dialog, and verify it can't be retrieved again
• Revoke an API key and confirm it disappears from the expanded row
• Disable a service account and verify the status chip updates and API key creation is blocked
• Re-enable a disabled account and verify new API keys can be created
• Visit Admin > CLI-API — verify redirect notice with working link to Service Accounts
• Open /flowctl/accessToken — verify copy button works, token is not visible on screen