Wallet API keys

Scoped Bearer tokens for programmatic access to the /v1 wallet surface. Use Authorization: Bearer tma_… on any request; verify scopes server-side; rate-limits enforced per key.