### Create a manager

`POST /api/v1/managers`

Creates a staff or reseller account. A manager needs at least one login identity, so email or username must be present.

- Authentication: manager session (JWT) or API token
- Permission: `prm_managers_create` (Create managers)
- Risk: write
- Rate limit bucket: `t_mutate`

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `email` | body | string | no | Login email. Unique within the tenant. Required unless username is given. |
| `username` | body | string | no | Login username. Required unless email is given. |
| `password` | body | string | yes | Hashed with Argon2id before storage, unlike a subscriber's. |
| `parent_manager_id` | body | integer | no | Defaults to the caller. Never null — a tenant keeps exactly one root manager, its owner. A named parent must be one the caller may act on. |

#### Request

```json
{
  "email": "giza@acme.example",
  "username": "giza-reseller",
  "password": "a-strong-password",
  "firstname": "Mona",
  "parent_manager_id": 41
}
```

#### Errors

| Code | Status | When |
| --- | --- | --- |
| `ERR_CONFLICT` | 409 | the email is already registered in this tenant |
| `ERR_CONFLICT` | 409 | the licensed manager ceiling is reached |