Create Extension Credential

Exchange a full Supabase session for a narrow installation credential.

The extension calls this once right after connecting, stores the opaque credential, and discards the session — so a compromised extension storage leaks a revocable, extension-only bearer instead of the account. Only a full session may mint; an installation credential cannot widen itself. The raw value appears exactly once, in this response.