Create Sse Token

Generate short-lived token for SSE connection (5 min expiry)

Stamps the caller's org onto the token. Resolving the channel here is what lets GET /stream stay database-free: that route returns a long-lived EventSourceResponse, so a request-scoped session there would pin a pooled connection for the whole stream.

Sync on purpose. The database work, when there is any, has to run in FastAPI's threadpool. An async def that called it directly would block the one worker's event loop for the checkout.

resolve_sse_mint_identity either reuses a just-resolved identity (no checkout) or opens a session and closes it before returning. The rate limit and the mint below never see a live session. #686's guarantee — nothing in the mint or the response holds a connection — still holds, including on the path that did touch the database.