A15: render the password (+ TOTP) confirmation page.

Reached via OAuth-callback redirect for password-protected users. Reads the LoginPending row to verify the token is live AND look up the user (so the rendered form knows whether to show the TOTP field). Pure read - no state mutation on GET (matches /verify GET pattern; mutation happens only on the POST verify endpoint).