Returns the PUBLIC key material and full operational metadata for a key.
This is the S2S source Core API proxies to from its migration export endpoint.

Security — public material only: private key material is never returned.

• Simple asymmetric key: publicKey carries the Base64 SubjectPublicKeyInfo.
• Symmetric key (kty=oct): publicKey is null (no secret material exposed).
• Composite key: only component PUBLIC keys are returned via components[];
  publicKey is null and no component private material is exposed.

Non-exportable keys (exportable=false) are refused with 400 Bad Request,
mirroring core-api's export behavior; no key material is present in the refusal.

Tenant isolation: a kid that does not exist for the authenticated tenant —
including a key owned by another tenant — yields 404 Not Found with a generic
detail that does not reveal the key's existence elsewhere.

Authorization: requires scope admin.keys.read.