Claim Guest

Restore a guest cookie on the current device so a subsequent authenticated request triggers the existing Case 4 merge.

Used by the cross-device magic-link flow: when Device A requests a magic link, its guest_id is embedded in the redirect URL. Device B hits this endpoint before completing Stytch auth, so the first authenticated backend call carries both the new Stytch session and the originating guest cookie — and get_current_user_or_guest transfers the trips into the new authed user.

Only unconverted guests (stytch_user_id IS NULL) are claimable. A converted row is already linked to a real Stytch account; letting anyone claim it would let an attacker hijack that user's identity on the device making the claim.