Exchanges a request token (generated during the Add-on authentication flow) for a user API token. Put the returned apiToken in the api_key header to authenticate all other API calls.

Request tokens expire one minute after creation and are consumed on first exchange — request a fresh one if this call returns 400 or 401. Use this endpoint instead of `POST /user` when an add-on has already authenticated the user on your side and you just need to obtain their elab API token.

Example:
```
{
    "requestToken": "abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123abc1"
}
```