Re-issue a beating credential to a client that legitimately lost one — a physician who reloaded the page mid-session.

This is the ONLY route besides creating a session and beating on one that returns a nonce, and it is deliberately expensive: hard rate limit, ownership check, and a counter on the session row. open_session used to do this job for free and unlimited, which turned its idempotence into a nonce dispenser.