List distribution destinations

Creates a collection owned by the api-key's linked user. Requires the `write` scope. ### Visibility Defaults to **team** — the publisher's other users (and other api-keys in the same usergroup) can see and list the collection. If the linked user may not create team collections, the default silently falls back to `private`; the response's `visibility` field reports what was applied. Requesting `team` explicitly when it isn't permitted returns 403 rather than downgrading. `private` collections are visible only to the owning (linked) user — including in this API's own `GET /collections` for other keys. ### Description `description` is accepted and validated but **not yet stored** — the collection data model has no description field today. Send it for forward-compatibility only. ### Idempotency Pass an `Idempotency-Key` header (a unique random string per logical create, e.g. a UUID) to make retries safe. The first successful response with a given key is cached for 24 hours; replays return the same body byte-for-byte with `Idempotent-Replayed: true`. Reusing the key with a different request body returns 422 `IDEMPOTENCY_KEY_CONFLICT`.