Mint the token a host page passes to KarumiChat.identify().

The whole point of the indirection: the chat routes the browser talks to are unauthenticated, so they cannot be handed a raw user id — anyone could name somebody else. Minting happens HERE, behind the organization's API key, and the browser only ever carries the result.

Call it server-side when rendering a page for a signed-in user and pass the token into the page. It is bound to this target and expires, so it is not worth much if it leaks and it cannot be replayed against another chat.

Args: request: The target and who the host is vouching for — its own user id, that user's email, or both. Prefer sending the email; see the request model. auth: The calling organization, from the X-Api-Key header. target_repo: TargetRepository dependency.

Returns: The token and its lifetime in seconds.

Raises: HTTPException: 404 when the target does not exist or is not the caller's — indistinguishable, as on /events. 400 when neither identifier is usable, 503 when the backend has no token secret configured.