Generates a short-lived (30-second) JWT token for a specific application purpose (e.g. WebSocket auth, third-party validation). Requires a valid bearer token. Returns a new JWT with all the same claims plus an application field. No refresh token or cookies are returned.