RBAC UI polish: API-key mint role selector + friendlier 403 surfacing

Follow-ups split out of PAR-187 (core RBAC UI shipped). Both minor:

1. API-key mint role selector. Backend already supports ApiKeyService.create(name, by, roleSlug) and new keys default to contributor; there's no UI selector yet. Add a role field to the /keys controller KeyReq + apiKeys.create(...) call, thread it through lib/api.createKey + createApiKeyAction, and add a role <Select> (backend roles) to the ApiKeys mint form so agents can be given an admin/viewer key.
2. Friendlier 403 surfacing. lib/api.call throws a raw tesks API … → 403 {"error":"…"} string on denial. Parse the backend's { "error": … } body and show a clean message in the action error path (the 403 handler from PAR-185 already returns structured JSON).