Create the traveler's account from their guest checkout session and sign them in. The one-time token comes from the magic link emailed during guest checkout. Re-posting the token after a successful exchange returns the already-created signed-in state without creating a second account. When the selection hold lapsed before the exchange, the account is still created and session.selectionExpired is true.