Mint a fresh owner token and its derived owner id

Returns {token, ownerId} where token is a 32-char base62 owner token and ownerId is its 64-char lowercase SHA-256 hex. Stateless: nothing is persisted. Send the returned token as X-Owner-Token when publishing to claim ownership.