Mint a token for the caller with the default granted scopes.

A mint never grants more than the caller already holds, so a caller that does not hold the whole default set cannot mint it here (403 scope_denied). The grant is fixed, so the gate is the whole rule on this route; the remedy is POST /credentials, which grants the caller's own set or less. The check runs before the label check: a caller that cannot mint at all should not learn the label rules.

The route refuses the reserved console-session label, exactly like routes/internal.py::create_user_token. A token under that label hides from the console token list and escapes the per-label cap.

A mint never outlives the caller either, so the caller's remaining life is the ceiling on expires_in and the child's expiry when the request names none. A caller with no expiry keeps the route's historical behaviour: no ceiling, and no expiry on the child.