Mint a unified credential for the caller.

The grant is variable, so the caller's own set bounds it: this route grants the default scopes the caller holds, or the subset the body names. A general credential therefore mints the nine defaults exactly as before, and a narrowed one renews itself instead of widening.

The caller's remaining life bounds the lifetime the same way. The ceiling is the earlier of the route's 30 days and that remainder, so an over-long expires_in still reads 400, and a caller with no expiry still reads the 30-day answer.