Check a pass and, when it is good, spend one admission.

Spends one admission when the pass is good. The check and the increment happen inside a transaction against a locked row, so two doors scanning the same ticket in the same second cannot both admit.

Every attempt is recorded, refusals included — "the door said it was already used" is a dispute somebody has to settle later. Staff can only validate passes belonging to their own account, and another account's pass reads as not found.

Requires the pass_validation plan feature. Without it this endpoint answers 403 even with valid credentials.