Keys limited to sandboxes

A key can now be limited to a few sandboxes and to what it may do to them: look, start and restart, stop, run commands, or reach files. It is served nothing else, so a watcher that restarts one server holds no key to the rest of your account. Make one with runtime keys create --sandbox <id> --actions get,create, or sandboxes and actions in POST /v1/keys and runtime.keys.create. See Teams.