Mint a single-use SSO deep-link that opens an instance signed in

Owner-only. Returns data.url, an https://<slug>.<base-domain>/#/sso?token=<jwt> deep-link the browser follows to land in the company already signed in as the owner — no email/password prompt. The token is a single-use, 15-minute HS256 JWT signed with the SSO secret the manager injects into each company, so the opencompany app verifies it offline and the mint never has to reach the (possibly-asleep) company. Signing it also kicks a best-effort resume so the cold wake starts while the browser follows the link; a resume failure does not fail the mint.