nx_mgmt_session_mint.nx

nx_mgmt_session_mint.nx -- CLI over nx_session_mint_lib: mint an M5 no-cookie session token (the X-Nishi-Session credential) from a server KEY BUNDLE, for a realm + handle, WITHOUT the OPAQUE passphrase. Sovereign equivalent of what /login issues on a correct password -- used to SELF-AUTHORIZE the mgmt control plane from the NAS-resident signing key (operator-authorized 2026-07-08: "mint a session from the NAS key"; strictly less power than the sudo already granted). uid_hash = SHA256(realm|||handle); if that handle is admin in the roles registry, the session is PRIVILEGED. CLI: nx_mgmt_session_mint <keysfile> <realm> <handle> <ttl_s> -> prints base64(token) on stdout.