`POST /api/v1/signup`

Status: stub. Day 3 deliverable.

Mints an API token. Idempotency, billing, and the legal envelope are all set up in this single round-trip.

POST /api/v1/signup HTTP/1.1
Content-Type: application/json
 
{ "email": "you@yourco.com" }

{
  "ok": true,
  "tenant_id": "…",
  "stripe_customer_id": "cus_…",
  "api_key": "wos_sk_live_…",
  "api_key_id": "…",
  "api_key_prefix": "wos_sk_live_…",
  "created_at": "2026-05-10T12:00:00Z"
}

api_key is returned exactly once. Subsequent reads see only the prefix. Same model as Stripe restricted keys / GitHub PATs.

Overview POST /policies