Mint a new S3 credential pair usable against the /storage/v1/s3
protocol gateway. The plaintext secretAccessKey in the response
is returned exactly once — it is encrypted at rest and can
never be retrieved again. If you lose it, revoke and re-create.
Limits: