Resolve a private docs magic link token to its login payload. Tokens stay valid for multiple uses until they expire, so email scanners that prefetch the link cannot lock the visitor out.