Mint Console Session

Mint a short-lived browser bearer for direct /v1/* calls.

Authenticated by the user's session JWT. The returned token carries (user_id, org_id, aud=console-v1) and is valid for ~10 min. The browser holds it in memory and presents it on POST /v1/compact (and, for admins, the deprecated /v1/capsule) direct to the API host (no Vercel proxy on the data plane).

Body must specify the target org. Prefer org_id (unambiguous); org_slug is accepted as a one-release deprecation path and is resolved against the caller's memberships only — 409 slug_ambiguous when the user belongs to ≥2 orgs sharing that slug.