Reactor: add POST /tokens; command paths aren't HTTP endpoints #643

Problem

Since #618, GET /v1/openapi/reactor returns a document: 145 paths, 12 models, 225 of 226 schemas tagged. Two problems stop a generated client from using it.

1. POST /tokens is missing. This is the only HTTP call a Reactor integration makes on the server. It mints the short-lived session JWT that @reactor-team/js-sdk uses in the browser. The endpoint exists: POST https://api.reactor.inc/tokens without a key returns 401.
2. The command paths are not HTTP endpoints. The document lists each model command as POST https://api.reactor.inc/reactor/{model}/events/{command} (for example /reactor/fast-h3/events/move). Those are sendCommand messages on the SDK's realtime channel. POST https://api.reactor.inc/reactor/fast-h3/events/move returns 404, the same as a made-up path. A client generated from the document sends requests that can't succeed.

Ask

1. Add POST /tokens to the Reactor document with its request body (authorization_details: [{ type: 'session', resources: { models: { match: [modelSlug] } } }]), its response (jwt, expires_at) and the Reactor-API-Key header.
2. Keep the command schemas, but don't publish them as HTTP operations on api.reactor.inc. Options: keep them as components only, or mark the operations with a transport extension (for example x-modelschemas-transport: realtime) so generators can skip them.

Acceptance

• GET /v1/openapi/reactor has paths["/tokens"].post.
• Every HTTP path in the document returns something other than 404 on api.reactor.inc, or carries a marker that it isn't HTTP.

TanStack AI generates its provider HTTP clients from these documents and type-checks each request against them (TanStack/ai#2104, TanStack/ai#2105). @tanstack/ai-reactor is left out of the generator until it can check its /tokens call.