Validate and register fmsgid addresses before issuing CLI API keys

[markmnl]

The operator CLI can currently print an API key for an address that is absent from fmsgid, leaving the key unusable at token exchange. Validate addresses before persisting a grant, and automatically register derived addresses using the same flow as the self-service API.

• api-key create requires an existing, accepting owner, registers the derived address with fmsgid's default quotas, then verifies that address before storing the key. Existing address settings are preserved.
• create-delegation requires both addresses to exist and accept messages; it does not provision delegated addresses.
• Harden the shared fmsgid lookup used by these checks: reject malformed or incomplete responses, scope cached and in-flight results to the configured service and address, and escape addresses in lookup URLs.
• Clarify CLI configuration, independent quotas, and rotation behavior in the README. Token exchange continues to reject unregistered addresses.

Validation: go build ./..., go vet ./..., and go test -race ./... pass with PostgreSQL integration tests enabled. New tests cover CLI registration and rejection paths, persisted grants and successful token exchange, rejection of unregistered derived identities, malformed responses, service-specific caching, registration cache invalidation, and address escaping. The lookup regressions reproduced the failures before the fixes.

GitHub build, vet, and race tests passed for db6a6b584ae493c54cd6c64be4d37c84acdec35c.

Cross-service validation: fmsg-docker integration run passed all 15 tests. The harness used merged Docker main (183133e8bbdfa286609221af5c8e8ba83dbfeb71), api-key-checks at db6a6b584ae493c54cd6c64be4d37c84acdec35c for fmsg-webapi, and main for the other components. No companion branches were used.