Mint a fresh access token. Cookie first, legacy body token as fallback.

Order matters both ways: the COOKIE is the D10 credential, so it wins when present and usable; the body token is honored when there is no cookie (a client on the old bundle) and when the cookie is present-but-unusable (a rotated JWT_SECRET_KEY, a truncated value, a stale cookie from another environment). Falling back on an unusable cookie is deliberate: the alternative is a hard lockout for a client that is still holding a perfectly good refresh token, fixable only by clearing site data.

Whenever the legacy path is taken we plant the cookie — the silent upgrade, so a user gets cross-host SSO on their next request without re-authenticating.