Resolve a typed user code (console only)

Turns a user_code a human typed into what approving it would grant: the client's registered name, the scopes the device asked for, and when the code dies. Session-JWT authenticated, exactly like POST /oauth/consent.

The code is normalized server-side — uppercased, with every character outside the BCDFGHJKLMNPQRSTVWXZ23456789 alphabet stripped — so dashes, spaces and pasted whitespace all work. The length check runs afterwards, so a typo that deletes a character is refused rather than silently resolving to a different live code.

Unknown, expired, already-decided and locked all answer the same 404. Distinguishing them would make this an oracle that confirms a code exists, and an oracle plus a few thousand requests enumerates every live code on the platform.