Create a Chrome extension token (`cke_…`)

Returns an opaque token once (cke_ + 64 hex), stored SHA-256 only. Requires the web session cookie: a Bearer (session token, ck_… API key or OAuth cko_…) is rejected with 401, so a stolen token cannot mint more. The token replaces the session cookie inside the Chrome extension (Authorization: Bearer cke_…) and therefore works on every plan, free included — unlike the ck_… API key, which unlocks the public API and MCP and needs a paid plan. Sliding expiry: 180 days, pushed back on every authenticated call. Max 5 live tokens per account (the oldest is revoked beyond that); rate-limited to 10/h per account and 30/h per IP.