Approve a pending MCP authorization with the agent's own credential

For an agent that created its own workspace (POST /credits/agent/signup or /credits/agent/register). The agent sends the lmo_req_ handle from its MCP client's authorization redirect with the lcac_ credential it received at signup, and receives the client's redirect URL with an authorization code. Credentials a person issued from the dashboard are refused. The resulting connection ends when that credential is revoked, expires, or the human declines the account.