When a guest clicks the magic link in their email, the RSVP is confirmed and the guest can manage their RSVP status using the same link in the URL.

Acceptance Criteria:
• Add a REST or query var–based endpoint to process token in URL
• Lookup comment via token and confirm:
• Token exists
• Token not expired
• If valid:
• Update comment_approved = 1
• Optionally delete token metadata (or mark used)
• When confirmed, allow continued RSVP editing while token is present in URL

Notes:
• Token could remain valid for some limited time (e.g. 7 days) for editing, or be persistent unless revoked
• Should gracefully handle expired or invalid tokens with a friendly error