Expose authenticated device approval presentation

[adrianwebb]

Add an authenticated, no-store JSON read for a pending device authorization request, using the SDK contract; keep API authoritative for expiry/status and never expose device_code.

[adrianwebb]

Managed acceptance on exact API rc45 / Admin rc16: API identity/team component verifier passes 6/6, including registration-confirmation-OAuth, account lifecycle, device approval, team authority/cleanup, residue cleanup, and audit evidence. The packed generation-71 composition graph passes 22/22 active guarantees. A final human-credential CLI device login remains to be exercised because the local CLI currently has no usable session.