CHW-1921 APIKeyScopeWideningDenied

cannot widen an existing key's scope; mint a new key instead

Default message: cannot widen an existing key’s scope; mint a new key instead
HTTP status: 403 (client)

Problem. A PATCH attempted to add a permission that was not already on the key. Cause. The narrow-only rule keeps the audit story clean: widening requires a fresh mint. Fix. Mint a new key with the desired scope and revoke the old one. HTTP 403.