Exchange a one-time claim token for its API key
Burn a one-time claim token and return the raw API key it carried — the public
exchange leg of QR onboarding (authed=False; runtime public-ness comes from the
always-public /api/login prefix).
The claim record is single-use: a used / unknown / expired token all answer the SAME
404 (no oracle distinguishing them). The handed-out key is guaranteed not-REVOKED
(re-validated at exchange), NOT owner-alive — owner-death is enforced by the gate on
every request. Response mirrors the loginResult wire shape:
{"data": {"token": <raw key>, "user_id": ...}}.
authority_changing=True keeps this OFF the default MCP tool surface: a
credential-exchange login door is not an agent tool (it sits outside the
/api/auth/* prefix, so the flag is what excludes it, not the prefix).

