Funnel Preview Token

Issue a short-lived token that lets the /funnel-auth web page call /previewCharacterImage before the user has an account.

Only mints tokens mid-funnel: the page must present the redirect_uri + state RevenueCat sent it, and the redirect_uri must have the same shape /auth/funnel/callback later enforces. These params are public/unsigned (RC offers no way to pre-validate a state), so this is a binding, not auth — it scopes generation to one funnel session and caps each session's budget.

Minting is deliberately unchallenged (no captcha): a token by itself costs nothing. Spend is bounded where it's actually incurred — the per-IP budget charged in preview_auth on each /previewCharacterImage call — plus the IP rate limit above as a flood backstop.