Refresh Order Intake Session

The mint response, and the entire browser contract (PLAT-22260).

The host backend forwards this verbatim to its page; it is not expected to add, rename, or reshape anything. Four fields, each earning its place:

• client_secret — the only value that authenticates the browser.
• expires_at — so the page can refresh before a request fails rather than discovering expiry as a broken widget.
• session_id — non-secret. The browser's cache key and the id that shows up in logs and support tickets, which is exactly why it is separate from the secret rather than derived from it.
• api_region — which Nash API the widget bundle should talk to, as one of the published wire tokens the widget loader accepts: "us" or "au". Never a deployment region string like us-west-1 — the browser resolves this against its own build-time endpoint table, not against server config (see embed_session_service.resolve_api_region).