Mint Agent Token

Mint a blog agent token (the owner authorizes an agent): {scopes: ["blog:write", "blog:publish"], label, ttl_days?, user_id?}. Only a PASTED global-admin token or break-glass (an elevated browser session is refused: it must not create lasting power, #1114). The token acts as a global-admin PERSON — the one the minting token is bound to, or user_id from AGENT_MDX_GLOBAL_ADMIN_USERS — and stops working the moment that person leaves the list, the token is revoked, it expires, or its scope's flag goes off. Shown once; the registry keeps its hash.