Generates a real signup/login token (24-hour expiry) and emails a customer-portal invitation link. No request body — all behavior is derived server-side from the customer record. Requires the customer to have portal access enabled, be active, have an email on file, and the company to have a customer portal configuration. Send is fire-and-forget (not awaited) — a 200 response does not guarantee delivery.