Connect a scoped phone capture link

Here id is the phone grant id from the QR URL. Send its fragment secret in the JSON body. No login is required. A valid unexpired grant returns only its scoped capture session and link; repeating the same secret resumes that active session without creating another contribution.