Issues a signed HS256 JWT access token valid for the configured TTL (default 1 hour).
Accepts either application/x-www-form-urlencoded query parameters or a JSON body
with client_id and client_secret fields.
Rate limited to 10 requests per minute per IP.