Exchange a programmatic user access token for the caller's credentials TenantApiKey.

The console signs a user in via /auth/v2/programmatic/{login,verify-email} (which return a Didit user access_token), then calls this once to obtain the /v1/ tenant API key that scopes all subsequent data calls. First call for an org provisions + seeds the tenant.