Resolve a pending client authorization for the consent screen

Resolves a pending authorization so the consent screen can render what the server actually stored: the client, the scopes and the resource restriction.

Accepts both the 8-character code a person types (CLI device flow, case-insensitive) and the 32-character code the browser flow carries in the URL. Never render the scope list from URL parameters — a forged link would then show one thing and grant another.

The confirmation code is deliberately NOT returned. The screen must ask the person to type the 8 characters their editor or CLI is showing, and send them as display to POST /v2/account/authorize/approve, which compares them server-side. Handing that value back here would mean anyone who learned the code could approve, and approval decides which account the client ends up connected to. In the device flow the person already typed it to reach this screen, so it can be echoed straight through.

approved: true means the request was already approved and the person should return to the client.

Session token only. Rate limited to keep the 8-character space non-enumerable.