Browser credential submit — agents should use /api/x-accounts/start instead

The browser form behind a connect link posts here; AGENTS CANNOT USE THIS. It REQUIRES a one-time token from POST /api/x-accounts/start, which is only delivered through the link the user opens — and the token is bound to the wallet that minted it, so a handle can never link to a different wallet. Use /api/x-accounts/start and give the user the link; never ask a user for their X password. Credentials arriving here are sealed in transit, relayed to the platform (encrypted at rest there), and never stored or logged by twitr.sh. Returns status=linked, or status=pending_code + challenge_id when an email code is needed (then /api/x-accounts/confirm). On 429 login_cooldown the account is temporarily paused: wait the Retry-After seconds, do NOT retry sooner (it extends the pause).