Preview Activation Code

Public (unauthenticated) preview so the landing page can show what the link grants before Google sign-in. Reveals link type, validity, and the label (prospect-facing copy on the offer card) — never redemption internals. Rate-limited: this is a code-validity oracle. The slowapi decorator buckets per path (per guessed code), so unknown-code lookups additionally burn a cross-path per-IP budget.