Exchange a fleet credential for a registry bearer token.

Docker sends Authorization: Basic base64(user:password) here, where the password is the caller's fleet token. The collector already authenticates Bearer tokens on every other route, so the "minted" token IS that fleet token echoed back — validated first, never issued blind.

That keeps identity intact: the follow-up /v2 requests carry a real fleet token, so require_read_or_emit resolves the actual producer rather than trusting a claimed username. No second token type, no HMAC, no key to rotate.