Issue a session token scoped to a business

Mint a new token scoped to `business_id`. A new token rather than an amended one: a JWT is signed, so it cannot be re-scoped in place, and issuing a fresh one is what stops the previous scope applying to subsequent calls. Membership is checked here as well as on every later request. Refusing at the point of switching gives the user a clear answer instead of a token that fails on first use.

curl -X POST "https://example.com/api/b/v1/context/switch" \  -H "Content-Type: application/json" \  -d '{    "business_id": "f59fcbb7-848d-4242-af07-a8bb7e3ab37c"  }'

{  "access_token": "string",  "token_type": "bearer",  "business_id": "f59fcbb7-848d-4242-af07-a8bb7e3ab37c",  "role": "owner",  "expires_in_minutes": 0}