Generates a pre-signed widget session so the embedded widget (starya-widget) can open
already authenticated as an existing client — linked to that client's existing chat —
instead of creating a new anonymous user.

This is a server-to-server call authenticated by the enterprise api-key. The client is
resolved by phone; when phone is omitted or does not match any client, an anonymous
user/chat is created (anonymous fallback, same behavior as the widget's register).

The response returns only a sessionId (never a raw JWT). The host hands it to the widget,
which re-issues its 1h JWT via POST /auth/widget/session/use with its own
x-api-key/x-site-id — so the sessionId alone is not usable outside the allowed site.