Submit the device approval decision (Approve / Deny)

Processes the device verification form. On Approve, binds the device code to the authenticated user and the chosen org (default: the user's personal org) — the claim-first ownership moment — so the polling client can then exchange it for tokens. On Deny, marks the code denied. CSRF-protected (signed token bound to user + client + user_code); session must still be valid.