Exchange staff credentials (super admin or company admin) for a JWT.

Send the token back as Authorization: Bearer <token> on every subsequent request.

Partner integrations should use an X9 Connect key instead — it is sent as X-Api-Key, is scoped to your company's groups and accounts, and does not expire with a session.