Validate a welcome proof as active merchant owner/staff

Requires a Better Auth session and an active merchant owner/staff role checked from the database. Corporate users and unrelated merchants have no access; a live platform admin role does not bypass merchant membership. Returns no customer account, name, phone, identity-document or health data. Repeated collection returns already_redeemed.

curl -X POST "https://example.com/v1/rewards/merchants/497f6eca-6276-4993-bfeb-53cbbbba6f08/validate" \  -H "Content-Type: application/json" \  -d '{    "qrToken": "string"  }'

{  "status": "ready",  "campaign": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "title": "string",    "deliveryKind": "physical_gift"  },  "expiresAt": "2019-08-24T14:15:22Z",  "redeemedAt": "2019-08-24T14:15:22Z"}