Looks up a company by id and returns its public identity plus whether it requires a
refund document. Used by the (unauthenticated) refund/payment flow to confirm the
counterpart company before continuing.

This endpoint skips user authentication and identifies the company via the company_id
field in the request, not the company-id header.