Mint a demo session: sign in as a demo account (admins only).

A demo session is a real sign-in as the demo account (not an impersonation, so no banner shows), for 2 hours by default and at most 8; it can be revoked at once, never makes the account an admin, and its cookies are written to a file only its owner can read, never printed. Answers a Playwright storageState for origin: hand it to sleeperhit capture record --storage-state <file>. Not idempotent (each call is a new sign-in, never replayed from a store), so it takes no Idempotency-Key. 403 demo_account_not_allowed unless the account is on the allowlist, exists, is not banned and is not an admin; 403 demo_session_credential_refused through a connected app's OAuth grant. Audited. Scope: account:write. Free.