Meeting Join

Resolve the wrapper token, on-demand-launch the bot, return the real URL.

The read → guard → launch runs inside a transaction holding a per-token advisory lock, so two near-simultaneous clicks (candidate + interviewer at the same second) can't both pass the guard and launch duplicate Recall bots: the winner launches, a concurrent loser sees the winner's bot (or bails on the lock) and just redirects. The lock key is the token, so different interviews never block each other.