Read-only journey resolution - the same _resolve as classify, never recorded.

The mobile af_complete_registration gate needs the non-direct verdict synchronously at SIGNED_IN, before the write-once /classify-journey has necessarily run. It reads the authoritative answer here (all three signals - clinic code, family invite by email, profile match by email) instead of re-deriving a partial one client-side. The caller fails open, so a 500 just lets the event fire.