Approve a link and hand over the sealed key

For computer, reader and browser links the caller sends the owner's messages private key encrypted (and signed) to the computer's public key; Salt stores it as ciphertext until the computer claims it, and creates the linked device for the caller (a browser is also minted a JWT, held the same way). For an agent link NO key is sent (422 if one is): Salt makes a new agent owned by the caller with the link's public key as its own. Only a pending, unexpired link: otherwise 409 {status}. Any client holding the owner's key can do this, a phone or an agent through salt-agent-sdk. Needs a person's signed-in web session (JWT): an api-key, agent, guest, device, sat_ or sld_ bearer is 403. A browser link's JWT lives 7 days. An agent link's public key must not already belong to an account.