Verify bootstrap token

Exchanges a one-time bootstrap token (generated by the CLI) for a setup session token. Rate-limited: 5 failed attempts per token hash triggers lockout.

curl -X POST "https://example.com/v1/setup/bootstrap-token/verify" \  -H "Content-Type: application/json" \  -d '{    "token": "string"  }'

{  "expires_at": 0,  "session_token": "string"}