Document creating keysets programmatically (and link to stack TypeDoc)

[coderdan]

Summary

Our docs should explain how to create keysets programmatically (not just via the dashboard), and that page should link back to the @cipherstash/stack Encryption() TypeDoc where using a keyset at the client is documented.

Why

The stack SDK now documents how to use a keyset (config.keyset, by name or UUID) and points developers at the dashboard to create/manage them. But for automated / multi-tenant provisioning flows, developers need to create keysets programmatically (e.g. spin up a keyset when a new tenant is onboarded). We don't currently document that path.

What to cover

• How to create a keyset programmatically (API / CLI — whichever is the supported path; confirm what we expose).
• Naming vs UUID identification, and how that maps to config.keyset: { name } | { id } in the SDK.
• The relationship to the workspace default keyset.
• A link back to the stack TypeDoc "Keysets (multi-tenant isolation)" section in Encryption() (cipherstash/stack → packages/stack/src/encryption/index.ts), so "create a keyset" and "use a keyset" are connected in both directions.

Related

• Companion to the isolation-hierarchy docs issue (keyset vs auth strategy vs lock context).
• cipherstash/stack: Encryption() TypeDoc documents config.keyset usage and links to the dashboard keysets page.

[coderdan]

Related: #47 (isolation hierarchy concept page) and cipherstash/stack#561 (per-operation keyset in the SDK).