Server-to-server counterpart of POST /private/v1/one-click/sessions.
After the embed emits PROPHETX_ONE_CLICK_SUCCESS with an
identityUuid, call this with that UUID: ProphetX fetches the shared
credentials from Verified Inc and creates the user exactly as
POST /private/v1/users does, returning the same body including the
sharedSecret.

Verified does not return an email address, so email and
emailVerifiedAt must come from you. The phone number and its
verification come from Verified's one-time code unless you override
phoneVerifiedAt.

Call this from your backend, never a browser — the response carries the
user's shared secret.