Tenant Key Management

Creates directories and optionally generates an API key for new tenants.

Keys map to tenant identifiers. Non-admin calls are tenant-scoped by their key.