Replaces account scope for the bearer's own Person session and returns a replacement token. The path sessionId must match the authenticated bearer; API-key bearers and cross-session updates return 403. When accountScope is non-null, wingspan-api first verifies the Person is authorized for the requested Account and that the Account is not Closed, then Authentication verifies the current live session, preserves auth methods and expiry, revokes the old session, and returns the replacement token. Send accountScope: null to create an unbound Person session. Clients MUST use the returned token after a successful patch.