Get Connect Token Public Preview

Public preview for a connect-token (QR code). Returns inviter display name + avatar + city + verification so the unauthenticated /connect/{token} landing page can show a human invite card before asking the visitor to sign up or log in.

Why a separate endpoint from GET /connect/{token}:

• The authenticated endpoint requires a Clerk JWT and writes a scan-log row (connect_token_scans) keyed on the scanner's user id. Both are inappropriate here — the visitor isn't signed in yet.
• This endpoint returns ONLY safe public-profile fields. No clerk_user_id, no email, no phone, no internal flags.

Status codes: 200 with status='valid' + inviter fields 200 with status='invalid' if token doesn't match anyone (prefer 200+status over 404 so the frontend can render a friendly "link expired" card without an error toast)

No rate limit yet — the surface is small (just a profile preview by random 32-char token; brute-force search is computationally infeasible). Add a coarse IP rate limit later if abuse appears.