Refuse a device request

Settle a request as refused, so the machine waiting on it stops.

No standing assertion: saying no grants nothing, and the account most in need of this button is one that did not start the flow at all — which is the phishing case (D-X16-O23). A denial the daemon then polls is 403 link_code_denied, which is what makes "somebody said no" different from "this code means nothing".