Redeem an approved enrollment (desktop app, no auth)

Exchanges the one-time code and the PKCE code_verifier for the device's own api-key, once. Replays, expiry and mismatches all answer 400 invalid_grant. Poll mode (the enrollment was created without redirect_uri) sends only {request_id, code_verifier}: 202 {status:"pending"} until a phone approves, 200 with the same body once, then 410 for denied, expired or already claimed. A wrong verifier is the same 400 as an unknown request.