Mint a capture-widget session token for a KYC check

Requires an API client bearer token.

Returns a 15-minute bearer token valid for repeated captures until expiry or the check leaves `collecting`. Use `capture_url` as the iframe `src` — it embeds the token in the URL fragment, which must not be logged. Hand the session only to the hosted capture widget — never your own OAuth client credentials — so the widget can post captured document images to the vision service on your behalf. Only mintable while the check is collecting.