Retrieves operational metadata for a single cryptographic key.

The response is an AdminKeyResponse containing identity, algorithm, lifecycle
state, usage counters, expiration timestamps, suspension / revocation /
destruction metadata (when applicable), and caller-editable fields
(displayName, description, exportable). Persistence-internal fields
(surrogate id, version, deletedAt, lazy composite components) are never
exposed.

Authorization: requires scope admin.keys.read. Cross-tenant reads are
rejected with 403 unless the caller is a platform administrator
(tenantId == ROOT_TENANT_ID), in which case any tenant's key is readable.