Get Nango Session Token

Fetch a short-lived session token from Nango for the Connect UI.

Pass ?allowed_integrations=supabase to scope the session to a single provider. Returns the full Nango session dict (includes token + any extra fields).

Note: the legacy endpoint calls Nango directly without provider validation, so we mirror that by going via the adapter rather than the MintNangoSessionToken operation (which requires a validated provider slug).

Per-resource permissions: any company member may start a connect flow — this runs BEFORE any integration row exists, so there is no resource to gate on. The creator is auto-granted ADMIN when the row is created.