Add visitor phone lookup flow

server/README.md

@@ -35,6 +35,11 @@ If a phone already has active tickets, ticket creation returns
 `DUPLICATE_PHONE`; repeat with the same request body except
 `allow_duplicate: true` and a new idempotency key after the employee confirms.
 
+`POST /api/public/status/search` is a temporary non-production operational-test
+endpoint. It accepts `{ "phone": "..." }` and returns all current active
+tickets associated with that phone. It is disabled when `APP_ENV=production`;
+replace it with OTP or an external identity interface before formal launch.
+
 ## Tests
 
 ```sh