Pick up the re-sealed keyring after a key reset

A linked computer or reader calls this with its own sld_ token; a browser sign-in with its JWT (found by its jti). Returns the keyring the phone sealed to THIS device's key (ciphertext only) until it is acked. A browser also gets a fresh jwt (Bearer...), swapped in on the ack. 404 {code:"no_pending_key", key_generation, sealed_key_generation, needs_relink} when nothing waits; needs_relink is true when the device is behind the person's key (the 14-day window passed): link it again. A pending key is dropped after 14 days.