Poll client approval status (approval-pending page)

Minimal tri-state poll for the approval-pending page.

Anonymous but keyed by the signed approval-state blob — never a bare client_id, so the endpoint cannot be used to enumerate registrations. Any verification failure (bad signature, wrong purpose, expired iat, malformed blob) is a 400 invalid_grant; the page reacts to a 400 by re-running /authorize, which mints a fresh blob. The response carries ONLY the tri-state — no names, redirect URIs, or metadata.