Build a viewer link

The auth token comes from your internal system (whatever issued it after login) - this page doesn't mint or sign anything, it just assembles the /watch URL. The watch page resolves the username by asking the internal system's check-username API for the token you paste in.