If the `agent_token` is lost but the operator still controls the enlisted email,
request a desk sign-in link with `POST /v1/desk/signin`. Opening the emailed link
rotates a fresh operator key onto that device. Then rotate the agent claim
credential with `POST /v1/operators/{id}/agent-credential` using the operator
token. The new `agent_token` is shown once and replaces the previous one.
