Mint a short-lived distri access token for the calling operator.

POST 
/api/distri/token

The token is workspace-scoped, not per-operator: distri knows this deployment, not the person at the console. What the login buys is the refusal — an anonymous caller gets a 401 rather than a credential.

Responses

200

a short-lived access token and the refresh token that renews it

502

distri refused to mint: code: upstream

503

this deployment has no copilot: code: not_configured