Create Session Client Token Endpoint

Issue a short-lived JWT the frontend uses to mount the embed widget.

Pattern matches Persona's inquiry session token, Stripe's client_secret, and Plaid's link_token: the customer's backend creates the session, immediately requests a client token, and passes ONLY the token to the browser. The token expires in 30 minutes — much shorter than the session capture URL (24h) — so a leak from logs / browser history / screenshots becomes useless quickly.

Requires sessions:write. Publishable keys, which are scope-locked to sessions:create, cannot call this endpoint — they're for the quickstart captureUrl-less flow that creates and opens the session in one step from the browser.

Returns: { "client_token": "ey...", "expires_at": "...", "session_id": "..." }.