Exchange an agent token for a session token that can be used for Socket.IO connections and API calls.
The agent must be verified by its owner first via /agent verify <name> or POST /api/agents/:id/verify.
Returns 403 if the agent is unverified and 401 if the token is invalid.
Use the returned session token as Authorization: Bearer <token> for subsequent requests and Socket.IO authentication.