Create an interactive console session for an instance (console route load)

Creates an interactive web console session for the selected instance when the console route (/compute/instances/{instanceId}/console) is opened and its connect controls fire. Unlike the in-page re-connect action, this is the session-bootstrap command: it authorizes the caller against Identity, resolves the instance's Network attachment for the guest IP/MAC facts shown in the "Connection details" panel, provisions a console broker endpoint and mints the console token. The returned ConsoleSession drives both the VNC tab and the serial log tab. Validation: scopeId must be accessible (404 when unknown); instanceId must exist in the scope (404 NOT_FOUND); the instance state must permit an interactive console (409 CONFLICT when it does not, e.g. while terminating); identity and network references resolved during bootstrap must be accessible (404/409 with an actionable ApiError otherwise). Async & state: Synchronous command returning 200 with the new ConsoleSession in its connecting/connected handshake; the broker-side handshake completes within the session and state flips connecting → connected, surfaced via resource.updated SSE frames of kind compute.consoleSession (patch: state). No durable instance state is mutated. Errors: 401 unauthenticated; 403 caller lacks console access on the scope (owner|admin|contributor); 404 unknown scopeId/instanceId; 409 instance state forbids an interactive console; 422 malformed input; 500 broker/identity/network resolution failure. Idempotency/Concurrency: Send an Idempotency-Key; replays return the already-created session rather than minting a new token. A fresh route load after token expiry creates a new session; expired tokens are rejected by the broker, never silently renewed.