Instant Signals prospect page payload (no auth — the token is the auth)

Resolves an 18-hex page token to the prospect page payload. 404 for a malformed or unknown token. 200 with state=expired (past the 25-day clock, no signal data touched), state=not_available (zero visible cards — takedown, zero-card run, or workspace-less lead), or state=ok with hero + up to 2 secondary cards + lockedCount. TD7 by position: locked write-up fields are never present in the payload. ?preview=1 (admin View-page link) skips view recording.