Mint App Scope Token

Issue a folder-scoped token for a running HTML app.

The browser asks for one when the person grants an app access, then attaches it to every bridge call so the server can refuse a path outside the folder. It only ever narrows what the caller already has, so minting is gated on the level being asked for: read-write needs EDIT_MOUNTS, exactly as the write itself does.