Authenticates with client credentials and returns a JWT token.

Important: A failed authentication still returns HTTP 200 — check that Token is not null.
If Token is null, the Message field contains the reason (e.g., invalid credentials).

Use the Token value as the Authorizer header on all subsequent API calls.
Tokens expire — re-authenticate before the Expires timestamp.