Exchange session code for bearer

Exchanges a one-time session code (from /session) for a short-lived public bearer.

• If the session was created with pkce_required=true (headless), a valid code_verifier is required.
• Codes are single-use and expire at code_expires_at.