Trades an SSO session_id for account-space tokens in a single call. The
backend resolves the account from the session, so no user identifier is
accepted -- which is what keeps this exchange clear of the
account_id-vs-id confusion the other account-space routes have to guard
against.

Takes no session of its own: the session_id is the credential, and it is
validated for age (24 hours from creation) and, where the session is flagged
single-use, for reuse.

This is the /api/v1 counterpart of the legacy
PATCH /sso/sessions/api/accounts route. The payload contract is unchanged;
the verb is POST here, matching every other session-minting route in this
family -- and matching what the legacy route's own OpenAPI block already
claims.