List feature flags (public; optional ?scope=system and ?key= exact-match filter)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.