Omit API key secrets from GET responses and clarify one-time retrieval

[krowvin]

GET /auth/keys and /auth/keys/{key-name} currently return "api-key": null, which suggests the secret should be available. Return only key metadata and remove api-key from both HTTP 200 response schemas. POST continues to return the generated secret in its HTTP 201 response.

• Add a bold notice to the POST and both GET Swagger panels: save the key at creation; it cannot be retrieved again.
• Document the creation-only secret field and preserve user, name, creation, and expiration metadata.
• Cover serialization and generated OpenAPI contracts; strengthen integration assertions to distinguish an absent property from null.

Companion UI guidance is in #1923, with bold warnings in the creation, save, help, and rotation instructions.

Validation: Java 11 service tests passed (745 passed, 40 skipped), including the three new serialization/OpenAPI regression tests; Checkstyle and WAR assembly completed. Rendered Swagger panels verified both bold GET notices and metadata-only examples. The full Gradle build reached the Docker-backed OpenAPI export, which failed because no Docker environment is available; Oracle integration and downstream generated-client validation remain unverified.

Swagger screenshots were captured outside the source tree. Attachment was blocked: the browser file chooser timed out, and native computer use stopped because it could not verify the Chrome URL.

AI tools used