fix(auth): handle device approval state errors

[pandemicsyn]

Summary

• Handle expected device authorization approval refusals as 404/409/410 JSON responses instead of unhandled 500s.
• Preserve unexpected exception reporting and existing same-origin/session authentication boundaries.
• Make approval and denial atomic, preventing competing requests from overwriting the winning state or user.
• Classify failed approval transitions using current persisted state, including exact-deadline expiry.

Fixes KILOCODE-WEB-20JD
Fixes KILOCODE-WEB-27K2

Sentry: https://kilo-code.sentry.io/issues/KILOCODE-WEB-20JD
Sentry: https://kilo-code.sentry.io/issues/KILOCODE-WEB-27K2

Validation

• Reproduced expected-refusal failures before the route fix.
• Reproduced concurrent two-user approval, approval-versus-denial, and expiry-boundary failures before their fixes.
• 78 tests passed across four suites: approval route, credential-issuance integration, denial route, and device-auth service.
• pnpm --filter web lint
• pnpm --filter web typecheck
• Targeted pnpm format and git diff --check passed.

Static review

• Independent subagent reviewed the full change and follow-up fixes.
• All findings addressed; final static review reported no remaining actionable findings.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/lib/device-auth/device-auth.ts
• apps/web/src/lib/device-auth/device-auth.test.ts

Previous Review Summaries (2 snapshots, latest commit 4b97aec)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 4b97aec)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/lib/device-auth/device-auth.ts
• apps/web/src/lib/device-auth/device-auth.test.ts

Previous review (commit 21c634e)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/app/api/device-auth/tokens/route.ts
• apps/web/src/app/api/device-auth/tokens/route.test.ts

---

_{Reviewed by grok-4.6 · Input: 36.6K · Output: 6.1K · Cached: 159.7K}

_{Review guidance: REVIEW.md from base branch main}