Attach an anonymously minted passport to the caller's account

Attaches an unclaimed passport to the authenticated caller's FLINT account. Two request shapes: { passport_id, claim_token } presents the one-time token from the mint's claim_url. { passport_id } alone works only when the caller's account already holds a pending-claim binding for this passport (begin_claim or refresh_claim_token while signed in, the MCP claim flow, or the flint_claim_intent cookie surviving an OTP delay). Every non-owned failure returns a distinct reason code instead of one shared error string.