Embed Session

Bootstrap a visitor and their chat, for the chromeless chat UI (TOS-3161).

The two existing embed routes (turn, forget) are a write-only echo: the reply comes back in the response to the visitor's own POST, and there is no way to read history or watch a reply stream. Reusing the product's real chat surface fixes that, but the real surface needs a chat_id and a vis_ bearer token to authenticate against GET/POST /api/chats/{chat_id}/... BEFORE the visitor has said anything - the UI wants to mount and show a composer immediately, not only after a first message.

This is that bootstrap, and only that: authorize the origin, mint-or- resolve the visitor, guarantee they have a chat, and hand back exactly what the chat UI needs to mount. No budget check, because no model call happens here - a visitor who loads the widget and never sends anything must not cost the agent owner a turn. The daily and per-visitor ceilings are still claimed inside send_message/stream_message themselves the ordinary way every chat turn claims them, unaffected by this route.