Bind a document class for a hosted full-flow capture session

Authenticates with client credentials — no bearer token required.

Forwards the request verbatim to identity-kyc's internal `set-document-type` endpoint and maps its response back to the widget faithfully — this is a thin passthrough, not a second copy of the business logic. No OAuth bearer token: `capture_session_token` in the body is the entire authorization, verified downstream when this handler calls identity-kyc. `document_type` is a flat string — the accepted-class enum and the class gates (environment extraction-provider, programme policy) are identity-kyc's business rule, not duplicated here; a request that violates them 400s with one of `class_select_not_supported` (not a flow-kind session), `document_class_locked` (document evidence already attached), `document_class_unavailable` (this environment cannot process that class), or `document_class_not_accepted` (the programme's policy has not opted into that class), forwarded verbatim. Served by the vision host, not the primary API host (see the second `servers` entry), same as documentScan/selfieSubmit/detailsSubmit — temporary pending the unified API edge (ADR-0043). Rate-limited per-source-IP (RIGID-591 pattern, fixed 60s window); a 429 carries a `Retry-After` header.