Switch Tenant

Issues a new token pair scoped to the caller's account in a DIFFERENT tenant they already belong to, given that tenant's tenant_id. Requires the person's own sign-in (403 person_session_required for API keys, portal links, agents and token-exchange tokens). An OAuth access token from an authorization-code grant is also accepted and answered with an OAuth-shaped pair (data.access_token, refresh_token, expires_in, scope, token_type) for the target account that keeps the grant's client and audience and never widens its scope (clipped to the client's current ceiling); it refreshes at /oauth/token by that client. The target account must already have authorized that client (403 consent_required), and the result is audited as auth.oauth_workspace_switched. 403 no_membership if the caller's person has no account in the target tenant — this does not create one (see joinTenant for that). Exception: a platform admin (cross_tenant role) on an interactive session (not an API key, OAuth or token-exchange token) who has no account in the target gets one created with their current role, whatever the workspace's join policy; the response then has is_new_account: true and the entry is audited as auth.tenant_joined with platform_admin_entry.