One-tap acknowledge (token)

The phone path. No session and no account: the token from the page link IS the proof, exactly like a magic link. It is hashed at rest and ACK-ONLY — it cannot read the escalation, resolve it, or reach any other row, so a forwarded link costs at most a wrongly-attributed acknowledgement. Idempotent; dies once the escalation is resolved.