tai auth claim
Exchange a one-time claim link for its API key — runs WITHOUT a credential.
Pass the bare token or the whole claim URL; the token is taken from the #claim=
fragment. The exchanged API key is printed ONCE — capture it now (there is no second
exchange; the link is single-use). A used/unknown/expired token answers the same
unknown or already used claim token.
Example: tai auth claim 'https://host/login#claim=<token>'
tai auth whoami
Print the caller’s derived capability projection.
Example: tai auth whoami