Claim an approved link, once (no auth)

The computer polls this with its poll_secret. Pending is 202. Approved is 200, by kind: computer and reader return the sld_ token (a reader's is read-only), browser returns jwt (Bearer..., a normal 30-day session) instead of token, all three with the sealed key (an armored PGP message for the computer's key, signed by the owner) and user; agent returns api_key, agent {id, handle, name} and owner, and no key. The secrets are then erased from Salt, so a second claim is 410. Denied, expired and already-claimed are 410 {status}. A wrong secret is 404, the same as an unknown id. linked_device is what the computer passes to DELETE /api/v1/linked_devices/{id} to unlink itself.