A shared report, by the link token in a header

The published snapshot a customer share link points at. The token travels in the X-Greentally-Share-Token header, never in the URL (Cloud Run's request log records URLs). A missing, malformed, unknown, expired or revoked token is the same 404. No /shared/ route takes the token in its path (spec 2026-10-05).