feat(api): add admin endpoint to issue keys for masters

Add `POST /admin/masters/{id}/keys` allowing admins to issue child keys
on behalf of a master. Introduce an `issued_by` field in the Key model
to audit whether a key was issued by the master or an admin.

Refactor master service to use typed errors for consistent HTTP status
mapping and ensure validation logic (active status, group check) is
shared.

internal/model/models.go

@@ -31,6 +31,7 @@ type Key struct {
 	Scopes        string `gorm:"size:1024" json:"scopes"`                 // Comma-separated scopes
 	IssuedAtEpoch int64  `gorm:"not null" json:"issued_at_epoch"`         // copy of master epoch at issuance
 	Status        string `gorm:"size:50;default:'active'" json:"status"`  // active, suspended
+	IssuedBy      string `gorm:"size:20;default:'master'" json:"issued_by"`
 }
 
 // Provider remains the same.