Get the calling API key's own metadata — name, prefix, scopes, expiry, last-used — and what it may do on this request.

Self-introspection. Returns 404 when the caller authenticated via federation/JWT (no API key in scope) and 401 when there's no authentication at all. Never returns the secret or its hash — only the displayable prefix. No `[RequireScope]`: a key must be able to read its own metadata regardless of what scopes it carries, otherwise narrow keys couldn't see what they can do. `scopes` is what the key was minted with. A personal access token acts as its owner and is cut down on every request to what the owner's current workspace role (`ownerRole`) carries, so `effectiveScopes` is what this request was authorised with: a scope in `scopes` but not in `effectiveScopes` is one the owner's role refuses. For a service-account key, `effectiveScopes` is the account's grant and `ownerRole` is absent.

curl -X GET "https://api.fruxon.com/v1/tenants/string/tokens/current"

{
  "ownerType": "USER",
  "ownerId": "string",
  "ownerRole": "ADMIN",
  "effectiveScopes": [
    "string"
  ],
  "id": "00000000-0000-0000-0000-000000000000",
  "name": "string",
  "keyPrefix": "string",
  "scopes": [
    "string"
  ],
  "createdBy": "string",
  "createdAt": 0,
  "modifiedAt": 0,
  "expiresAt": 0,
  "revokedAt": 0,
  "lastUsedAt": 0,
  "binding": {
    "kind": "string",
    "kindLabel": "string",
    "resourceId": "string",
    "resourceLabel": "string"
  }
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}