feat: add 'kosli get api-key' command

[mbevc1]

Add a 'get api-key' subcommand that fetches a single API key's metadata via GET /api/v2/service-accounts/{org}/{name}/api-keys/{key_id}, completing CRUD support for service-account API keys alongside the existing create/list/rotate/delete commands.

The command takes a positional KEY-ID and a required --service-account flag (consistent with delete/rotate), supports table and json output, and only ever returns key metadata - the secret value is shown once at creation/rotation time.

Also creates a reusable function to calculate timestamps.

Closes #991

[claude]

Claude finished @mbevc1's task in 1m 56s —— View job

---

Review: kosli get api-key

• Gather context (diff, changed files)
• Static analysis (go build, go vet)
• Review code quality, edge cases, tests
• Post review summary

---

Verdict: LGTM. This is a clean, well-scoped slice that completes CRUD for service-account API keys. It follows the established delete/rotate/list conventions faithfully and the latest commit already resolved the earlier DRY note by extracting apiKeyMetadataTimestamps.

Static analysis

Check	Result
go build ./...	✅ pass
go vet ./cmd/kosli/...	✅ pass
go mod tidy	not run (no go.mod/go.sum changes in this PR)
Unit/suite tests	⚠️ could not execute — go test was not in my allowed tools. Build+vet pass and the test code reads correctly; the suite tests need the local server per CLAUDE.md. Please confirm make test_integration_single TARGET=TestApiKeyCommandTestSuite is green locally/CI.

What's good

• Consistent with existing patterns — getApiKeyOptions, PreRunE global-flag check, RequireFlags, url.JoinPath, and the FormattedPrint table/json map all mirror listApiKeys.go/delete/rotate exactly.
• DRY refactor landed — apiKeyMetadataTimestamps (apiKey.go:34) is now shared by both the get renderer (apiKey.go:117) and the list renderer (listApiKeys.go:103), so the two can't drift. This addresses the prior review comment.
• Security-conscious — the metadata struct (apiKeyMetadata) has no Key field, and the long/short help explicitly state the secret is only shown at creation/rotation. Good.
• Solid test coverage — arg-count validation (0/1/2 args), missing --service-account, ak alias + -s shorthand, table vs json output, N/A rendering for zero timestamps, and a 404-surfaced-as-error case (apiKey_test.go:507). Fixture-driven contract in testdata/service-account/ keeps response bodies in one place.
• No alias collision — ak is unique among get subcommands (get.go:21-34).

Minor / non-blocking observations

• Shadowing url (getApiKey.go:65): url, err := url.JoinPath(...) shadows the imported url package. It's correct (RHS evaluates before assignment) and matches listApiKeys.go:67, so it's consistent — just noting it as a readability micro-nit shared with the existing code; no change needed.
• printApiKeyMetadataAsTable assumes a single object. The get endpoint returns one object, so this is correct. If the API ever returned an array on this path the unmarshal would error out cleanly rather than misbehave — fine as-is.

Nothing here blocks merge. Nice, tidy addition. 👍
· 20260706_get_key