Redeem Setup Token

Consume an account-setup token and set the account's password.

Rate Limited: 5 requests per minute per IP address.

Does not require authentication — the token is the credential. Each failure mode gets its own status so the page can tell the user what to do next; none of them names the account, so a guessed token reveals nothing. The status table lives with the exceptions rather than as a ladder here, so a new refusal cannot reach the client as an unmapped 500.