Fix one-time API key delivery after subscribe wins create race

[chen21019]

Fix API-key create-only first delivery when a redacted subscribe event arrives before POST201. Only the API-key editor opts in; one-time values go to its detached clone, not the canonical store. Preserve concrete identity, account/store/generation/base binding, save-owner cleanup, existing permissions and ordinary save consumers.

Current signed candidate: daab6e8; tree: 8f6c8eb930fe77d6983a37e9b30912a384af5e7e.
Current validation: https://github.com/PastureStack/web-console/actions/runs/37109872791 (in progress; not yet passed).
Previous run 37109247143: 806/808 passed, two failures retained. Corrected actual Resource intl fixture and transport/rejection barriers without changing runtime code or weakening assertions. Run 37109091223 was superseded and cancelled, not a pass.

Fourteen actual Store regression cases plus two save-owner cases include 100 deterministic personal-store barriers and 100 project-store barriers. Release assets will be exact immutable CI outputs only after all tests and PR checks pass. Server packaged native delivery and the full permission/resource/locale matrix remain separate and incomplete; no company deployment or zero-CVE claim.

[chen21019]

Superseded by #164: signed single-parent commit with exactly the tested tree 8f6c8eb930fe77d6983a37e9b30912a384af5e7e. Signed artifact source daab6e8 and completed CI 37109872791 remain unchanged. No branch protection bypass, force-push, artifact rebuild, or historical evidence overwrite.