Get session token

Fetch the current session identity token for a captain thread. The caller must have access to the project that owns the thread. The same token is also written inside the captain VM to /etc/capy/session-token with permissions 0600, so code running inside the VM can read it locally. A 410 response means the session has already ended. A 422 response with code session_not_ready means the token has not been minted yet during initial bootstrap; retry with backoff.