"""User-scoped device-flow protocol endpoints (RFC 8628). Public —
unauthenticated, per-IP rate-limited. Approval/deny + SSO branch land
here in Phase D.
"""