Create a new MCP token for the authenticated vendor. The token is minted against the vendor account and scoped to the mcp:skin-analysis ability only, so it can reach the MCP server but nothing else on the Oyster API. Restricted to the vendor owner. The plaintext token is returned once and cannot be retrieved again.