Service Account Create

Create a pending service account bound to one active product. Control gives it a service client of its own (`svc-<service_account_id>`), the product's `service` role and Control's `product-runtime` role, which grants the session and gateway validation calls and nothing else. The account cannot authenticate until `service-account.register` records its certificate and `service-account.set-status` activates it. Platform-level accounts (no product) are never created through this API. A caller bound to a product may only create accounts for that product.

POST /internal/control/v1/service-accounts