Mints an Aqueduct MCP access token for first-party agent infrastructure.

The Aeolus bridge authenticates with its short-lived Agent credential and receives an at+jwt token restricted to that credential's user and project. The bridge injects it into its agent harness's MCP client configuration.

There is no refresh token or grant row because this is first-party runtime infrastructure, not a connected third-party OAuth client. The bridge re-requests a token while its scoped runtime credential remains valid.