Hosted device approval results

New-device approval and denial links now finish on explicit result surfaces. When a project has a valid callback, the engine can hand back a bounded status after it processes the token.

The hosted page gives the person a clear result even when the application has no safe return URL configured.

The result page does not create an application session and does not trust arbitrary query values. Applications still need their own authenticated follow-up before granting access.

Approval tokens are consumed by the engine before a callback is considered. The application must treat the callback as a notification and re-check its own authenticated state.