Changelog

Keys are managed by a person’s session: the website, or a signed-in CLI’s session token (arena keys). Never by a key.
POST /api_keys/{id}/rotate: rotate with a grace period.
Every keyed response carries RateLimit-*, Arena-Quota-* and Arena-Plan. New GET /usage.
New scope markets:read: GET /instruments, /instruments/search, /instruments/{ref}, /games, /games/{ref}, and the quotes routes.
New GET /portfolio and GET /portfolio/trades under portfolio:read.
Venue references and prices are served only while the venue-data switch is on. It ships off: quotes routes answer 403 venue_data_off.

Accounts are private by default. A private trader answers private: true with every number null and an empty pick list.
A public trader whose earlier trades are still hidden has numbersShown: false.
The key owner reads their own picks (with placedPrivate and shown) and GET /me/eval under portfolio:read.