feat(auth): add scoped access key suspension lifecycle

docs/auth/authentication/using-authentication.mdx

@@ -134,17 +134,23 @@ Pass `--expires-in <seconds>` to request a specific finite lifetime. Pass
 `--expires-in none` only for deployments where the administrator has explicitly
 allowed unlimited keys.
 
-List keys or revoke one by its stable `jti`:
+List keys, temporarily suspend and restore one, or permanently revoke one by its stable `jti`:
 
 ```bash
 nemo auth access-keys list
 nemo auth access-keys list --page 2 --page-size 100
+nemo auth access-keys suspend ak_0123456789abcdef0123456789abcdef
+nemo auth access-keys unsuspend ak_0123456789abcdef0123456789abcdef
 nemo auth access-keys revoke ak_0123456789abcdef0123456789abcdef
 ```
 
-The list includes each key's `ACTIVE`, `EXPIRED`, or `REVOKED` status plus its
-description, issuer, audiences, creation time, and expiration time. Revocation takes
-effect on subsequent authenticated platform requests. Rotation is not implemented.
+The list includes each key's `ACTIVE`, `EXPIRED`, `SUSPENDED`, or `REVOKED` status
+plus its description, issuer, audiences, creation time, and expiration time. Suspension
+and revocation take effect on subsequent authenticated platform requests. Use suspension
+to temporarily block a key, such as while investigating suspected misuse, without
+permanently revoking it. An unexpired suspended key can be restored with `unsuspend`. If
+the key expires while suspended, `unsuspend` is a no-op and reports `EXPIRED`. A revoked
+key cannot be restored. Rotation is not implemented.
 
 ### Token Inspection
 

docs/cli/reference.mdx

@@ -281,6 +281,8 @@ nemo auth access-keys [OPTIONS] COMMAND [ARGS]...
 * `create`: Create a Scoped Access Key for the currently...
 * `list`: List Scoped Access Keys owned by the currently...
 * `revoke`: Revoke a Scoped Access Key owned by the currently...
+* `suspend`: Temporarily suspend a Scoped Access Key owned by the...
+* `unsuspend`: Restore a suspended Scoped Access Key owned by the...
 
 ##### nemo auth access-keys create
 
@@ -339,6 +341,44 @@ nemo auth access-keys revoke [OPTIONS] JTI
 
 * `--help, -h`: Show this message and exit.
 
+##### nemo auth access-keys suspend
+
+Temporarily suspend a Scoped Access Key owned by the current user.
+
+Unlike revocation, suspension is reversible until the key expires.
+
+**Usage:**
+
+```shell
+nemo auth access-keys suspend [OPTIONS] JTI
+```
+
+**Arguments:**
+
+* `<JTI>`: Stable ID of the Scoped Access Key to suspend.
+
+**Help:**
+
+* `--help, -h`: Show this message and exit.
+
+##### nemo auth access-keys unsuspend
+
+Restore a suspended Scoped Access Key owned by the current user.
+
+**Usage:**
+
+```shell
+nemo auth access-keys unsuspend [OPTIONS] JTI
+```
+
+**Arguments:**
+
+* `<JTI>`: Stable ID of the Scoped Access Key to unsuspend.
+
+**Help:**
+
+* `--help, -h`: Show this message and exit.
+
 ### nemo services
 
 Run platform services locally.