Waiting Requests

What /connect shows a signed-in visitor. Read-only, and scoped to their address.

This replaces the typed-code lookup. A person who opens /connect, reads what is being asked and closes the tab has consented to nothing, so rendering must not be a state change.

The scope is the whole control surface here, and it is deliberately the address on the session user's own account rather than "every pending request": an unbound pairing row is attributable to nobody, so an unscoped list would show — and let anyone approve — a stranger's request. approve_pairing re-asserts the same address under its row lock, because a control this query enforces is a control one direct API call removes.

pending_count is carried alongside for the reason SP-21 introduced it: three waiting reads as suspicious where one reads as routine, and that signal cannot work if it is never rendered.