Issue a widget turn delegation token

Path and body turn_ref must match. Only the current submitted widget turn younger than 30 minutes may exchange a token. Context and person must match; session must be live, AI entitlement active and scope within the configured upper bound. Validate the bound host session on every issuance. Exchange the server-side user access token for the host product audience, then reread turn and session before returning. Discard tokens after interruption or revocation. Tokens are never persisted or logged. Tenant-level exchange omits project_id in Control form data. No caching.

POST /internal/assistant/v1/turns/{turn_ref}/token