Issue an integration grant for a demo account (admins only).

The one credential a recorder needs to provision this allow-listed demo account's capture sessions through the sleeper.capture/1 API (/api/capture/v1) with no human sign-in. The token is answered ONCE and only its SHA-256 is kept: write it to a mode-600 file or a secret store and never print it. Lasts days (default 90, at most 365) or until revoked. Not idempotent (a replay would hand the token out again), so it takes no Idempotency-Key. 403 demo_account_not_allowed unless the account is a usable demo account. Audited. Scope: account:write. Free.