Create hosted billing portal link

Creates an expiring provider-hosted person management link. Open it as the buyer in a browser. Adding cards and interactive payment approval stay in the hosted UI; the API never accepts card details or provider/client tokens. Return URL is fixed to Dashboard. Requires billing.write, a verified person and owner role. Subject to rollout-agent-access-writes (default off) and allow-public-agent-writes before account/provider effects. Return and person handoff URLs always use the canonical Dashboard origin; redirect URLs, payment details and provider tokens are not accepted.