Secure booking and report access shell

This surface is reserved for guest booking lookup and future report access. The token is treated as an access artifact rather than a user account.