Social Connect Token

Mint a short-lived, one-time login_token for an already-authenticated user so a client (e.g. the CLI) can obtain the session/auth_token via /auth/social/exchange — reusing the same machinery as the Google flow.

The raw auth_token is never handed to the client over a loopback URL; the exchanged token is one-time (its jti is consumed off the user row) and short-lived.