Create Chat Identity Token

Mint the token a host page passes to KarumiChat.identify().

The whole point of the indirection: the chat routes the browser talks to are unauthenticated, so they cannot be handed a raw user id — anyone could name somebody else. Minting happens HERE, behind the organization's API key, and the browser only ever carries the result.

Call it server-side when rendering a page for a signed-in user and pass the token into the page. It is bound to this target and expires, so it is not worth much if it leaks and it cannot be replayed against another chat.

Args: request: The target and the host's own id for the signed-in user. auth: The calling organization, from the X-Api-Key header. target_repo: TargetRepository dependency.

Returns: The token and its lifetime in seconds.

Raises: HTTPException: 404 when the target does not exist or is not the caller's — indistinguishable, as on /events. 400 for an unusable id, 503 when the backend has no token secret configured.