Exchange a session for an embed token

Exchanges a one-time embed session id (created via POST /api/v1/embed/generate-session) for a signed, short-lived embed JWT used to authenticate the embedded analytics in the browser.

The session is single-use: it is consumed (deleted) on the first successful exchange, so a given sessionId can be redeemed only once. The returned token is signed with the tenant’s embed secret, issued by cubecloud, and expires after 24 hours.

This endpoint is unauthenticated — it is called from the embedding client and the session id itself is the credential. Returns 401 if the session id is unknown or has already been redeemed.