Mint Session

Mint an HttpOnly session cookie from the caller's Firebase JWT.

The client calls this whenever Firebase auth state changes. The cookie replaces the ?token=<jwt> query param on tile URLs (MAIA-1715) — Mapbox caches URLs but always picks up cookies fresh from the jar, so the "tile-URL goes stale during long idle" bug class is eliminated.

Exempt from the terms gate because the cookie is tiles' only auth channel (Mapbox cannot send custom headers) and the mint is driven by Firebase auth-state changes, which do not re-fire on acceptance. A user who accepted while the mint was blocked would otherwise have a broken map until their next sign-in. Every endpoint the cookie unlocks is itself gated.