Signs a user in and takes the next step for them whenever there is only one to take: a user who belongs to exactly one organization is scoped to it, and if that organization has exactly one business they can sign in to, scoped to that too. Responds with active, the pair to make requests with, and selected_organization_id / selected_business_id saying how far the scoping got. A candidate that fails to verify is not an error: the response comes back scoped as far as it got, and the caller presents its picker for the rest. Also switches an existing session: pass access_token with an organization_id (and optionally a business_id) and the token is rebuilt from the scope-free base, so it carries exactly one organization and at most one business rather than accumulating the old scope alongside the new one. A named organization or business that will not verify is an error, unlike the greedy path.