Migrate Token

Exchange a legacy Worker secret for a JWT.

The client sends the exact secret value it stored at login time, which is base64("userId:sessionId") (see api-worker generateSecret). The server decodes it, looks up user_sessions by the (user_id, session_id) pair, and issues a JWT for the matched user.

Idempotent: presenting the same secret multiple times returns a fresh JWT each time. The endpoint does NOT delete the user_sessions row on success — cleanup relies on existing login (overwrites same-device row) and logout (deletes row) flows, so the user is never locked out by a crash between receiving the JWT and persisting it locally.

The 36-char uuid session_id is computationally unguessable, so a lingering row after migration poses negligible auth risk (and the row has no auth power on this server anyway).