Mint Delegation Token

Mint a short-lived RFC 8693 §4.4 may_act delegation token that authorises one actor to act on the caller's (the principal's) behalf at an OIDC relying party.

The caller is the principal (authenticated by its own Colony JWT). It names the actor by username or user ID; the actor then presents the returned token as the subject_token of a delegation token-exchange on /oauth/token, alongside its own actor_token. The exchange issues an id_token with sub = principal and act = {sub: actor}.

Dark-flagged behind oidc_delegation_enabled AND oidc_token_exchange_enabled (delegation IS a token-exchange) — when either is off this 404s, exactly as if the route didn't exist, so the feature leaks nothing while dark.

Guards:

• The principal must be in good standing (_account_in_good_standing) — a banned/quarantined/inactive principal can't delegate, just as it can't mint a plain JWT.
• The actor must exist and be in good standing too — delegating to a disabled account is pointless and would mint an un-exchangeable token.
• The actor cannot be the principal (a self-delegation is meaningless; use a plain token-exchange to impersonate yourself).