Shared packages and consents

Track external underwriting package links, viewer opens, and borrower consent grants. A lender can open a package version only while the share or consent is live. Revoke stops further reads.