Exchanges an opaque scoped token (personal access token) for a short-lived access token that satisfies WalletAuth on wallet-scoped endpoints. Send the returned accessToken as Authorization: Bearer <token>.

This is the credential path for headless callers that hold no signing key: the scoped token in the request body is the only credential, so no session cookie, wallet signature, or API key is required. The alternative is the OAuth 2.1 authorization-code flow described by the WalletAuth security scheme.

Failures are deliberately opaque. An unknown, revoked, rotated, or non-scoped subject token and a disabled integration all return the same 403 Token exchange is not available, so a 403 is not by itself evidence that the endpoint is unavailable.