/api/eaas-console/environments/{id}/chat-session

Dashboard ChatSurface bootstrap: the operator's OWN session JWT (the Authorization

bearer value — the identityToken is never taken from the body) is exchanged for an

identity-principal session bound to the target environment, so the chat area talks to

the exact /api/v1 principal faces (conversations/messages/artifacts) with real

budgets and real 402s. The publishable key used under the hood is created per

(tenant, project) and cached per pod process; there is no operator-facing key

management route yet (registered as a Gate B ops obligation). Expired environments

answer 409.