Create a new scan session for QR code-based skin analysis flow.

The returned batch_id should be encoded into a QR code for customers to scan.
When the response includes a broadcasting block, clients may subscribe to
real-time status updates instead of polling — but should always keep the
GET /skin/scan-session/{batch_id} poll as a fallback, since the block is
absent whenever realtime is unavailable and the socket can drop mid-session.

WebSocket events:

• Channel: scan-session.{batch_id} (public — the batch ID is the token)
• Events: bind every name in broadcasting.events. The event renames
  itself per status: images_uploaded carries the images-uploaded
  transition, status.changed carries analyzing, completed, failed and
  expired. Binding one name silently misses the others.
• Payload: { batch_id, status, reason, expires_at, completed_at }, plus
  images on images_uploaded. Read status — there is no valid field
  on the wire (it exists only on the REST status response).