Scoped API keys for AI agents: give each sub-agent a key that only touches one inbox

A full-access API key can list every address, mint more keys, and open billing. A research worker and a support worker should not share it. Cooper Email lets the orchestrator mint a key pinned to one