Show a template confirm page or consume a plain magic link

A usable token with a known template slug returns 200 text/html and does not consume the token, including when Sec-Fetch-Site is cross-site. The page title is Continue sign-in. The page says a form is not created until you continue, and the form POSTs to this URL with the same token. A plain usable link is consumed and returns 302. A plain link redirects to /app, a safe next path, /app/forms/{id} after a preview claim, /app?preview=expired, or /tools/p/{token}. HEAD does not consume a token and does not set a session cookie. A usable template link still returns that 200 page. A usable plain link returns 200 with an empty body and Cache-Control no-store. A later GET on a plain link still signs in. A missing token returns 400 { error: "token required" }. An unknown, used, expired, or wrong-purpose token returns 400 { error: "invalid or expired" }. A consumed link with no client IP returns 400 { error: "missing_client_ip" }. No API key.