Consume Callback

Consume a magic-link token and mint a session.

Single-use at the DB level (see _consume_link_atomic). The first POST returns the session; any subsequent POST with the same token is a 401.

CSRF posture: this endpoint accepts an opaque magic-link token that the attacker would already need to have. The token is the bearer credential; a cross-site forced POST without the token is just an empty request that 422s. We still apply the Origin check middleware to all state-changing routes (see main.py).