Mint a tenant-scoped mablnet operator session (peer JOIN credential + operator-command token)

Issues two short-lived signed artifacts the calling user needs to drive a mablnet operator session against a specific customer workspace:

1. A peer_credential — an Ed25519-signed blob the operator presents at JOIN time to be admitted as a peer in the customer's tenant. The api's /authorize/host endpoint recognises role: "peer" and validates the signature in lieu of an api_key check.
2. An operator_token — an Ed25519-signed blob carried per-request in OperatorCommand.token. The customer Host's MablOperatorAuthorizer validates the signature, checks the embedded workspace_id matches the Host's own workspace, and verifies the requested capability's required scope is in the granted scope list. Both artifacts bind to one customer workspace (the workspace_id request parameter) so a leaked credential cannot cross tenant boundaries. The mabl-deployment private key is held in Cloud KMS; the api never sees the bytes. For operating on the Router fleet itself (not a customer Host), use /authorize/operator/fleet. Auth: user-OAuth callers only — operator tokens are an interactive support / engineering capability, not a workspace-scoped API. Requires both the mabl support-admin claim and access to the tunnel, because the two answer different questions. Tunnel access — a user who can modify the workspace (owner, editor, or a support admin where the workspace has enabled Support Access), a company member for a company-owned tunnel, or the owner of a personal tunnel — is what /authorize/peer asks on its own, since minting a peer credential for test training is ordinary. The token minted here instead carries drain:host, carrier recycle/disconnect and fault injection, so consent gates the reach and the support-admin role gates the capability. The mabl global-admin claim administers mabl's own resources and grants nothing here. Scope policy: every admitted caller gets the whole tenant scope catalog — every read:*, probe:destination, the recycle:carrier / disconnect:carrier / drain:host mutations, and the diagnostic + fault-injection start:* / stop:* activities. Reaching the tunnel is the access control; there is no tier behind it. Callers do not request scopes — the api decides. Lifetime: 30 minutes per issued session; callers re-fetch when needed.