Mint a short-lived SIP JWT for the browser dialer

Replaces the queue's roster with the supplied extensions, IN ORDER, and pushes the workspace to the phone system. **API-key scope:** `queues.manage`. Viewer members are refused (`accounts.write_denied`). A LIST, not a set: the order is what `chosen_order` means. It is always stored, whatever the sharing mode, so switching modes later keeps the order you set. Positions come back 1-based; every agent is at level 1 (preference bands are not offered yet). WHOLESALE REPLACE: an extension left out is unbound from this queue and stops receiving its calls. The person is not deleted — they belong to the workspace and may serve other queues. Sending `{"agents": []}` empties the queue. All-or-nothing: every extension is resolved BEFORE anything is written, so a typo in the fourth name leaves the roster exactly as it was rather than half-applied. Each extension must be one with a LIVE LINE in this workspace — the devices that ring for it are resolved from your current records at save time, never taken from the request, so a re-enrolled app keeps ringing without a roster edit. A PSTN number is not an extension and cannot be a roster entry. Setting somebody's roster does not change their ACD status: a person the switch has on a break stays on it.