Owner/admin self-service CRUD for service accounts: POST create,
GET list, PATCH status; workspace-scoped with 404 existence hiding
for cross-workspace targets. Gated by require_workspace_admin.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>