Allow one of your personal tokens to write the workspace guidance card, for a while

Requires the authenticated web session; every Bearer token, including admin scope, receives 403 FORBIDDEN (Guidance write grants require the web session). The caller must be an owner or admin of workspace (403 otherwise; a slug that is not the caller's answers 404 NOT_FOUND) and tokenId must be one of their own live personal tokens (404 NOT_FOUND otherwise); a workspace-bound token can only be allowed for its own workspace (400). The grant lasts durationMinutes (default 60, at most 1440) and supersedes any open grant on the same token and workspace. It never replaces the owner/admin role the token's person must still hold at write time, and the granted write itself must carry confirm: 'guidance' and expectedUpdatedAt (see updateCard). Every granted write is recorded on the events ledger with the grant and the person who allowed it.