Key restrictions

Three optional restrictions can be attached to any key at creation, and using
them is the difference between a credential and a scoped credential. All three
are absent by default, and absent means unrestricted.

ip_allowlist — a list of CIDRs checked against the caller's source address.
A request from outside the list is rejected with 403.

path_scope — a list of glob patterns checked against the request path. A
request outside the scope is rejected with 403. This is how the Prometheus
scrape credential is confined to /metrics and nothing else.

expires_at — an epoch timestamp after which the key is rejected with 401.

The recommended posture for an NMS integration is a read_only key, scoped by
IP to the polling host, with no expiry (so a silent expiry cannot break
collection unnoticed), and a separate admin_only key held out of automation for
snapshot and key operations.