Mint a short-lived end-user JWT identifying the caller, as a member of their active organization, to the dashboard's own embedded assistant — the dogfood copy of a customer backend's ~5-line mint. The signing org is not the caller's active org: the embedded assistant belongs to the one workspace owning DASHBOARD_ASSISTANT_PUBLISHABLE_KEY, resolved on every call so a revoked or rotated embed fails loudly (503) instead of signing for a stale workspace. Signed HS256 with that org's end-user JWT secret (created on first use), expiring in one hour.

Org-scoped and gated on assistant.use like every dashboard route, because the token names who pays (TEA-1326): the end user is "<profile uuid>:<organization uuid>" and paying_organization_id is the active org, whose own funding the assistant's turns spend. The token is never a capability to act.