Creates the guest (edm_… token) that opens alerts and watches, and the secret that signs the webhooks. No sign-up.

The token is issued and signed by the account library, with a cap per network and per hour, so that the free allowance does not become infinite. It is shown only once and cannot be recovered: sign in to the account and bring the lists to it (POST /api/auth/claim, which the account page does by itself at sign-in) so that you do not depend on it. The webhook_segredo can be read again at GET /api/dono. Every webhook POST has webhook-id, webhook-timestamp (Unix seconds) and webhook-signature: v1,<base64>: HMAC-SHA256 of id.timestamp.corpo with the key of your whsec_… (the base64 after the prefix). It is the Standard Webhooks pattern: any library of it checks it; reject a timestamp outside 5 minutes. After POST /api/dono/segredo, the previous one still signs for 24 h (two v1, parts in the header). Returns: { token, aviso, webhook_segredo, webhook_assinatura, franquia }