Sub-ticket of ENAMEL-69 Narrow service capability for /api/soporte: create-plus-grant in one call, a non-admin role allowlist, appKey pinned to the service scope, and fn_correctUserEmail exposed - so no service actor ever needs admin@terra · enamel