App and agent API key lists return full secret tokens

The console key list endpoints for apps (and agent access points, plus the per-dataset route) return the full bearer secret for every key.

Any workspace member with edit permission can list them, so a non-admin editor can copy long-lived service API credentials that stay valid even after the member is removed. Only deletion is admin-gated.

Dataset key lists at the workspace level already mask secrets and show the full value once at creation. App and agent lists should do the same.

Start by locating the console list endpoints for apps, agent access points, and per-dataset keys, then compare them with the existing workspace-level dataset key listing behavior. Verify the response handling and relevant tests, if present. Done means list responses mask bearer secrets while creation still exposes the full value once.

Written by the indexing model from the issue text.