Claim Visitor Session

Hand an anonymous embed visitor's conversation to the signed-in caller (TOS-4550).

Same-site only: this is an authenticated /api/me route, reached with the caller's own session, not the CORS-scoped /api/embed surface. It exists because thinqos.com and app.thinqos.com are same-site, so a visitor token minted while chatting on the marketing site is readable from this app's own localStorage once the person signs up here. A visitor embedded on a THIRD-PARTY customer domain is storage-partitioned from this origin and cannot reach this route at all; that case is out of scope (see TOS-4550) and is not silently pretended to work.

resolve_visitor is called with same_origin_transport=True for the same reason embed_session uses it: the token was minted while the caller was on this app's own origin, not a customer's, so the stored origin can never match a customer origin here. origin is otherwise unused on that path and is passed empty.