Mint a token for a named client. Re-pairing an existing label replaces its token (and invalidates the previous one). Returns the new token.