Routing

Mint short-lived subscription tokens for org-scoped realtime channels. Each channel is authorized exactly like the Centrifugo subscribe proxy authorizes it, from this request's own verified session: the org boundary (membership, ``mfa_required``, IdP reach and SSO revocation, require-SSO) plus the channel's own scope (a private conversation's owner, a bot's visibility). The boundary is evaluated once per org in the batch. A granted token expires (``exp``) and Centrifugo enforces that locally, so a subscription made with it ends unless the client keeps presenting newer tokens. This route refuses them once one of the facts above refuses the session, even when Centrifugo cannot reach the API (PlatDev #4534). Exception: a signed-out or revoked FIRST_PARTY session. Its bearer JWT is honoured until it expires, here as on every REST route, so it keeps minting until then. Every ``exp`` counts from before the first fact is read. A batch that outlasts the whole lifetime gets no tokens; it is answered with a retryable 503 instead. Per-channel results, never all-or-nothing: one refused channel does not cost the client the rest. Duplicates are answered once, at their first position. ``personal:`` channels are refused as ``invalid_channel``; they are authorized by the connection token alone and need no subscription token.