Scoped API credentials and service accounts for the Sync Cloud API

Request: Add support for scoped access on the Sync Cloud API, so a given credential can be limited to specific Groups rather than the entire org.

Current state: The Sync Cloud API authenticates with an org-wide mTLS certificate generated in the admin portal, with a maximum of two certificates per tenant. Every certificate carries full access to all devices and Groups. The Sync Portal itself already supports role-based access and organizes rooms into Groups, so users in the UI can be limited to what they manage. The API does not inherit that scoping.

Why this matters: We run a distributed environment with multiple units, each responsible for its own Groups. Today the only way to give a unit API access is to issue a certificate that also grants access to every other unit's devices and data. That breaks least privilege, prevents clean per-unit attribution, and means a single leaked or rotated credential affects everyone. With only two certificates per tenant, per-unit separation is not even possible using separate certificates, and revocation is effectively all-or-nothing.

Requested capabilities (any one helps; ideally the full set):

1. Scoped API roles: allow a certificate or token to inherit a role's Group scope, so a unit's credential only reaches its own Groups.

2. Scoped Personal Access Tokens: let a scoped user account issue its own PAT that inherits that account's role and Group scope, with independent per-token revocation and last-used visibility.

3. Service-account credentials: a non-user credential type intended for automation and integrations, also Group-scopable, so a workflow does not depend on an individual's account and can be managed and revoked on its own.

Nice to have: extend the existing per-certificate last-used indicator to also show the credential's scope, and make the two-certificate limit configurable so scoped credentials can be issued per unit.