Resolve a referral code to the referrer's first name

Public (unauthenticated) endpoint for the referral landing page. Returns only the referrer's first name. Every failure answers 404 so the page falls back to a name-less hero and the endpoint cannot be used to probe.