`GET /storage-key/iam-template` — the four ADR-0066 deployment artifacts (role template, key-policy statement in two forms, OIDC snippet), rendered for the requested account. A pure read: no storage-key row, no AWS call. Admin gating stays in the logic layer, like every sibling here.

{  "account_id": "string",  "cloudformation_yaml": "string",  "deployment_order": [    "string"  ],  "federation_issuer": "string",  "identity_provider_known": true,  "key_policy_statement": "string",  "new_key_cloudformation_yaml": "string",  "oidc_provider_cloudformation_yaml": "string",  "permissions_policy": "string",  "region": "string",  "role_arn": "string",  "token_subject": "string",  "trust_policy": "string"}