feat(apikey): simplify issued token identity linking

[jmgilman]

Summary

• Refresh README and package docs around the current API-token prototype, examples/notes, deferred scope, and failure mapping.
• Change apikey.IssuedToken.IdentityLink to return authkit.LinkIdentityRequest so callers can pass it directly to LinkIdentity.
• Update the notes example and affected tests to use the simplified identity-link flow.

Validation

• git diff --check
• go test ./...
• moon ci --summary minimal