Start Runtime Handoff

Mint the signed URL that logs this member into the connector runtime.

The site and the runtime keep separate user tables. Before this route, a customer who subscribed here and was sent to mcp.advisorppc.com arrived as a stranger and their site password was rejected (#153). This hands the runtime a short-lived, single-use assertion of who they are, which tenant they belong to, and what they are paying for, so the runtime can create or link its own account instead of asking them to sign in again.

Admin-gated like the sibling /{slug}/oauth/start and /{slug}/review/start routes: the runtime turns the assertion into a personal account carrying this tenant's paid plan, so a read-only member must not be able to mint one. Interactive sessions only — an API key is a machine credential and must not be upgradable into a browser session for its owner — and never under superuser act-as, which would stamp the customer's tenant and plan onto the operator's own runtime identity.

POST rather than GET on purpose: the response body is a credential, and a GET would be prefetchable, linkable and loggable as a URL.