AI lead intake - conform to chatbot spec: accept & store 'state' (canonical, nullable) from payload; default status to 'pending' so leads land in the Open/New view (was followUp); return 401 (not 403) on bad Auth-Token; show Outlet/Shop Name column in lead search results