Register a new machine (returns a single-use install secret)

Creates a machine row owned by the caller. It serves es-python and es-chromium; every other product is registered at POST /scanner/<product>/generate, which returns the machine's token and its install command in one response, and naming one here is a 422 that says where to go. Which fields apply depends on product: es-python (the default) takes either nothing (the build is detected on the host when its install runs: os_type and python_version are stored as auto and resolved by /install.sh from what the install command reports) or a distro+arch pair (os_type = distro_arch, validated against the supported targets) with a python_version that must be available for that target (422 otherwise; see GET /api/supported_python_versions/?os=); python_version=auto picks the host's own version at install. es-chromium takes the name alone. A new es-python machine gets machine-scope socket=on and file=on taint settings for each of the two the account has not set account-wide. You must hold the product you name (403 otherwise). Enforced atomically against the caller's machine limit, which is counted PER PRODUCT, so a full es-python allowance does not consume the es-chromium one (409 when at cap). Cookie callers must pass CSRF; API-key callers are exempt.

This is a write: a read-only API key is refused with 403.