Probe a demo claim link without consuming it

HEAD does not consume the claim token, does not write to D1, and does not set a session cookie. A usable token returns 200 with an empty body and Cache-Control no-store. A missing token returns 400 { error: "token" }. An unknown, used, expired, or wrong-purpose token returns 400 { error: "invalid" }. A later GET still claims the organization. No API key.