Mint a publish token for one of your sources

Signed-in session only: the web cookie session, or the session token from releases login as a Bearer. API keys, machine tokens and OAuth access tokens are refused. Cookie requests must come from the web origin. Mints a relk_ token bound to one source, usable ONLY on that source's POST …/releases/batch route (e.g. from the publish-changelog GitHub Action). Requires a verified ownership claim on the source's organization; the token stops working if the claim or the source goes away. The plaintext token is returned once. At most 5 active publish tokens per source per user.