Generates a fresh EC P-256 keypair for the authenticated application and
returns the new public key (JWK) and private key material (appPrivateJwk).
The private JWK is returned only once - store it securely. After rotation:
The keyVersion field is incremented on each rotation.
Obtain a token from POST /v1/auth/token using your client_id and client_secret, then enter Bearer <token> here.