Public invite-token exchange. Consumes a valid Person invite, verifies email ownership, and returns a Person session for first-session setup. Use sessionToken as an ordinary Authorization bearer. To set the first password, call POST /v3/platform/persons/{personId}/reset-password with {newPassword} and no token, within 30 minutes of redemption.