Returns a paginated view of cryptographic keys owned by the specified
tenant, optionally filtered by lifecycle status.

Response shape: a Spring Page<AdminKeyResponse> envelope with
content (the array of keys for the current page), totalElements,
totalPages, number (zero-based page index), size, and the standard
Spring pagination flags (first, last, empty, numberOfElements).

Pagination: server-side via Spring Pageable. Default size=25,
default sort createdAt,desc. Max size=200 (rejected with 400 above).
Sort fields allow-list: createdAt, expiresAt, alg, kty, status,
kid. Any other sort field returns 400. Sorting by kty orders over ONE
vocabulary: every composite key carries the single coarse token COMPOSITE,
so the ordering is over the published key types and not over a column whose
values follow two conventions.

Query parameters:

• status (optional): filter by exact lifecycle state, using the SAME token a key's
  status field carries in the response — active, pending_rotation, rotated,
  expired, revoked, archived, deleted_logical, suspended,
  pending_destruction. Absent or empty means no filter.
• kty (optional): filter by exact key type, using the SAME token a key's kty field
  carries in the response — ML-KEM, ML-DSA, SLH-DSA, FALCON, XMSS, LMS,
  HQC, FRODO, CMCE, BIKE, SABER, NTRU, NTRUPRIME, RSA, EC, OKP,
  oct, SM2, GOST-EC, and COMPOSITE for every hybrid pairing. A composite key's
  construction is carried by compositeMode and its pairing by alg, never by kty.
  Absent or empty means no filter.
• origin (optional): filter by exact key origin, using the SAME token a key's origin
  field carries in the response — GENERATED or IMPORTED. Absent or empty means no
  filter. Any other value is rejected with 400, never answered with an empty page.
• page (optional, default 0): zero-based page index.
• size (optional, default 25, max 200): page size.
• sort (optional, default createdAt,desc): sort field + direction.

Authorization: requires scope admin.keys.read. Cross-tenant listing is
rejected with 403 unless the caller is a platform administrator
(tenantId == ROOT_TENANT_ID).