Signup Claim

Claim a handle and mint the user's first bearer token.

Past the password gate, this endpoint is the moral equivalent of:

POST /v1/admin/handles      (create the handle)
POST /v1/admin/tokens       (mint a bearer token)
+ welcome-thread seed       (so first inbox isn't empty)

Mirrors the result of /v1/handles/reserve — same handle row, same token row, same welcome-thread seeding — just gated on the page password instead of a magic-link reservation.

Returns the raw bearer token in the body. The token is shown ONCE; if the user loses it an admin must revoke and reissue.

Body: { "password": "...", "handle": "leslie", "display_name": "Leslie" # optional, defaults to handle }

Returns: { "ok": true, "handle": "leslie@tandem-cc.com", "token": "tandem_...", "snippets": { "desktop": { "mcpServers": { ... } }, "code": { "mcpServers": { ... } } }, "warning": "This token is shown ONCE — copy it now ..." }