Validate Invitation

Resolve a pending invitation token for the accept page.

Unauthenticated by design — the invitee has no account yet, so the opaque token is the credential (same posture as password-reset validation). Returns the invitee email + company name, or a domain error (404 / 410) if the token is unknown, consumed, or expired.