Account-key auth & the Projects API

# 1. One project per customer org. NOT idempotent — a repeat call with the
#    same derived name creates a second project with a suffixed slug, not an
#    error. Check your own store first if you might have already provisioned
#    this customer.
curl -X POST https://api.craftkit.dev/v1/projects \
  -H "Authorization: Bearer $CRAFTKIT_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Acme Corp" }'
# → 201 { "id": "…", "slug": "acme-corp", "name": "Acme Corp" }

# 2. Mint a project key scoped to that project.
curl -X POST https://api.craftkit.dev/v1/projects/<id>/keys \
  -H "Authorization: Bearer $CRAFTKIT_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Render service (prod)" }'
# → 201 { "id": "…", "prefix": "ck_live_aBcDe", "key": "ck_live_…" }  — store `key` now.

# 3. Render as that customer, from then on, with their cached ck_live_ key.
curl -X POST https://api.craftkit.dev/v1/templates/invoice/render \
  -H "Authorization: Bearer <cached ck_live_ key>" \
  -H "Content-Type: application/json" \
  -d '{ "data": { "customer": { "name": "Jane Doe" } } }'

const BASE = 'https://api.craftkit.dev';
const acctHeaders = {
  Authorization: `Bearer ${process.env.CRAFTKIT_ACCOUNT_KEY}`,
  'Content-Type': 'application/json',
};

async function provisionCustomerProject(customerName: string) {
  const project = await fetch(`${BASE}/v1/projects`, {
    method: 'POST',
    headers: acctHeaders,
    body: JSON.stringify({ name: customerName }),
  }).then((r) => r.json());

  const minted = await fetch(`${BASE}/v1/projects/${project.id}/keys`, {
    method: 'POST',
    headers: acctHeaders,
    body: JSON.stringify({ name: 'Render service (prod)' }),
  }).then((r) => r.json());

  // Persist minted.key against this customer now — it is never returned again.
  return { projectId: project.id, slug: project.slug, apiKey: minted.key as string };
}