Describe a pending device authorization for the approval page (T832)

Public, rate limited. Backs the /link approval screen: given the user_code shown on the device, returns what the human needs in order to decide -- which client asked, from which host, which scopes, and when the code expires. Carries NO secret: no device code, no API key, no tenant. client_name and hostname are client-supplied claims that identify the request; they do not authorise it. Unauthenticated for the same reason approve/deny are (see denyDeviceAuthorization's note): a pending row has no tenant yet, and the code on the device's screen IS the authorization boundary, per RFC 8628. An EXPIRED pending grant is reported as status: expired rather than 404, because the page has to tell a human who waited too long what actually happened.