`POST /v1/auth/magic/mint` — internal endpoint the bot calls when a user runs `/web`. Authenticates via `x-internal-secret` (constant-time compare against `BOT_INTERNAL_SECRET`). Inserts a fresh nonce row and returns it. No JWT is issued here — that happens on consume.

curl --request POST \
  --url https://api.pegana.xyz/v1/auth/magic/mint \
  --header 'Content-Type: application/json' \
  --header 'x-internal-secret: <x-internal-secret>' \
  --data '
{
  "telegram_id": 123
}
'

{
  "expires_at": "2023-11-07T05:31:56Z",
  "nonce": "<string>"
}