Exchange a CLI credential

Supply exactly one of loginId or refreshToken. No authentication header is required. A loginId polls a device login started by cli.startDeviceLogin. While the user has not approved it, the API returns HTTP 202 with a Retry-After header in seconds. Approval returns HTTP 200 with access and refresh tokens exactly once. Denial returns HTTP 403. An expired login returns HTTP 410. Stop polling on either response. Device polling is rate limited per IP address. A refreshToken rotates an existing session and returns HTTP 200 with new tokens. The user's current membership and permissions are checked again. Reuse of the previous token after the retry grace period revokes the session. Access tokens last 15 minutes. A session expires after 7 days without a refresh, and no later than 30 days after login.