Mint the least-privilege token the iOS share extension stores in a shared Keychain group and sends to POST /saved/import. It is scoped to saved:import only, so a leak can't touch the rest of the account, and it replaces any prior share-extension token for this user so exactly one is ever live. The app re-mints when its stored copy is missing or near expiry.

Guests get a token too: a guest has a real backend user_id, and the import path already accepts a guest's token, so the share extension works for not-signed-in users without forcing a login first.