Issues an anonymous session token, the credential a client holds before it
has any account. Takes no authorization of its own -- this is the bootstrap
step. An optional program_id or external_program_id scopes the token to a
program so catalog filtering applies.

This is the /api/v1 counterpart of the legacy POST /anonymous-sessions
route; both share the same implementation, so behavior is identical.