Routes the client calls for customer contacts, read from raven-client, with the ownership check each id route needs, and the proposed shape of the fix (allowlist in the token middleware plus per-route ownership checks). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>