Create Session

Claim a sandbox directly, WITHOUT an approved plan.

This predates the approval gate and is kept for the manual-provider dev flow and the test suite. The SPA no longer calls it — it goes through /plans → /plans/{id}/approve, which is what enforces "the user saw a quote and said yes" and what freezes a spend ceiling onto the lease. A lease made here has no ceiling, so the budget guardrail skips it.

Worth closing off once nothing but tests depends on it; leaving it open means the approval gate is a UI convention rather than a server one.