Auto-renewal one-click enable page (from email link)

Public endpoint (no authentication required). Validates the HMAC token from a pre-warmed expiry offer email and renders a confirmation page. The page's button POSTs back to this URL to actually enable auto-renewal — GET never mutates the account, so email security scanners that prefetch links cannot opt an account in.