Looks up a pending invitation by its invitation_token and returns the
invitee email, the inviting company (name/country), a resolved user_id if
the email already has an account, and the list of all companies covered by
that token (bulk invitations share one token).

No authentication required — this endpoint is reachable before the
invitee has logged in, so it declares security: []. It is not scoped to a
company.