Returns the current user's Borealis access and id tokens (read from the server session established at sign-in). API equivalent of the legacy /IdentityServer/UserTokens MVC action. Anonymous so it never depends on the bearer token it is itself responsible for handing out (the EngageUser policy would be circular here); authorization is the session cookie. Returns 401 when the session has no tokens, clearing the stale login cookie/session so the next request re-authenticates. Gated on the full-page SSR toggle: this exists for the SSR bootstrap, and CSR clients still use the legacy /identityserver/UserTokens route, so there is no reason to expose a second anonymous token-dispensing route on tenants that have not opted in.