Mint the bridge-scoped vault viewer token

vault-recovery-custody (consult round 1): the console key bridge seals THIS token — never the full control-plane bearer — to git.run402.com. Scope is structural and read-only: only the vault read routes plus whoami and the org/project list reads accept it; every write surface rejects the bearer by token class. Bound to the parent session's row (sign-out or admin revoke kills it; the 12h absolute cap bounds it; an access refresh does not break it), 30-minute expiry, non-refreshable.