Self-serve: issue a FREE API token by email

A conventional token endpoint over the same key store as POST /keys. Submit an email; get a free-tier token, emailed once (durable copy) and returned once here. Only ever mints a FREE token (no privilege escalation); the owner/HMAC secret is never exposed. Paid tiers are granted via Polar checkout (POST /checkout). Throttled per IP; one active token per email.