Slack Identity Link Start

Public entry point for the link the bot posts in the DM.

Unauthenticated by design (Slack never sends Clerk credentials) -- validates the token WITHOUT consuming it, then hands off to the frontend, which authenticates the user via Clerk and completes the bind by calling POST /identity-link/callback. (The Connections-page UI this redirects to is Phase 5 of the plan and does not exist yet in Tranche 1 -- this route's contract is stable regardless of when that UI lands.)