Resolve an Order Stream Grant token to its Stream Window state

Public endpoint: the token is the credential. Malformed, unknown, revoked, and expired tokens all return the same 404 so the route is not a validity oracle.