Return a short-lived Amazon Ads access token

Three callers, two auth paths (autron-agent#441, #626):

• seller_public_id + a ppc_audit_service-scoped JWT (agent server-minted, never carried by a user session): restricted to PPC-audit sellers — the lead-audit pipeline, where no user exists.
• seller_public_id + a user bearer: that seller, authorised by user_may_manage_seller. The agent's CLAIMED audits use this — a report knows its seller, and inferring one from the user instead gave nothing at all for an invited teammate (who never has a primary) or the wrong Amazon account for anyone whose primary is a different seller in the same company.
• User bearer alone: the user's primary seller, exactly as before.

Scope is decided first, so a service token keeps the lead-audit path and its event == "PPC Audit" restriction — the user path is not a way around it.