Load a pending request

First-party, session-authenticated: what the consent screen renders. Returns the client's name, the literal host the code will be sent to, and one plain-language sentence per scope, because "codes:write" has not obtained informed consent from a restaurant owner whose printed menus are at stake.

Answers 404 — never 403, and never a description — for an unknown, expired or already decided request, so a signed-in stranger cannot probe which requests exist.