Generate v3 Auth Token

Optional identity fields to bind into the token. PII fields (id_number, given_names, last_name, email, phone_number) are validated as plaintext, then tokenized via the PII vault — the issued JWT carries opaque pii_-prefixed vault token ids, never raw PII. country and id_type stay plaintext in the claim, and callback_url is replaced by a resolvable callback_-prefixed id. Downstream v3 endpoints inject these fields server-side, overriding any matching fields in the request body, so identity data bound to the token cannot be altered by the client. Fields provided here make the corresponding request body fields optional on downstream endpoints; GET /v3/services/config lists them as token_provided_fields.