Complete consent (console only)

Called by the console once a human approves, authenticated with their session JWT — the only session-gated piece of the OAuth surface. Mints a one-time PKCE authorization code and returns where to send the browser.

A user cannot consent to more than they hold. Every workspace in workspaces must be one the calling principal has a grant on (403 otherwise), and the approved scopes must be within what their roles on those workspaces permit. max_role is a ceiling only: Kairos takes min(grant role, max_role) per workspace, so naming a role higher than the user's does not elevate anything.

Send deny: true to refuse — the response redirects the client to its own redirect_uri with error=access_denied, and no code is minted.