Issue a passwordless, single-use magic-link token for the end-user memory portal (T424)

Tenant-authenticated -- the caller is the tenant's own backend, which knows the subjectId and is responsible for delivering the link to the end user (ContextQ has no notion of a subject's email address and sends no mail itself). The returned token is shown exactly once, single-use, and expires in 15 minutes; the caller embeds it into whatever URL/UI convention it wants pointing at its own frontend, which then exchanges it via the separate, unauthenticated POST /api/subject-portal/verify for a short-lived portal session. Always succeeds for a well-formed subjectId, whether or not that subject has any memories yet. See docs/arch/subject-memory-portal-api.md for the full contract. Rate limited to 5 requests / 10 minutes per (tenant, subjectId).