Open Instruction Link

Where a floor instruction's signed SMS link lands: shows the instruction's own text and acknowledges it via="link" -- the ONLY thing this route does. The web page that renders this payload is NOT built by this slice (see the PR body's open items); this is the API half only, same split open_offer_link already uses for the surge offer's own link.

⛔GATED BY SESSION AND BY THE SIGNED LINK, same posture open_offer_link already takes: the token names an instruction; the session must be the principal it was sent to, or this 403s rather than show (or acknowledge) somebody else's instruction.