Mints a TOP access code for the given account and texts the member a link to
it, valid for seven days. Accepts an anonymous session or a partner session,
matching the legacy route: an anonymous caller resolves the partner and
program from configuration, while a partner caller supplies
external_program_id.

This is the /api/v1 counterpart of the legacy
POST /accounts/sms/top-access-code route; both share the same
implementation, so behavior is identical.