Exchange a GoTrue refresh token for a mnemom_session cookie

Mirror of /auth/cli-exchange in the opposite direction. Called by the SPA after landing on a Supabase implicit-flow redirect (magic-link login), whose session tokens arrive in the URL fragment. The endpoint performs the GoTrue refresh grant server-side — proving possession and consuming the single-use refresh token — then registers a session and sets the HttpOnly mnemom_session cookie. JSON-only; no redirect parameter. A refresh token belonging to an email whose domain enforces SSO is refused with 403 sso_required and no session is minted (SSO logins establish their own session and never use this route); if that check cannot be completed the response is 503 sso_check_unavailable. Rate-limited like sibling auth endpoints.