API keys: optional expiration and read-only scope

You can now set an expiration date and a read-only scope on your API keys, and the create flow has been redesigned to make keys easier to copy and test.