Mint a guest visitor JWT for the embeddable widget

Cross-origin endpoint called from the widget bootstrap. The caller supplies the pk_live_ client key in the body; the server validates the request Origin against the per-key allowlist before minting a short-lived visitor JWT. No Authorization header required.