Approve sign-in

This is a development stand-in for the real 1code.id flow. In production this screen is 1code.id's QR-scan + phone biometric approval — the password-less moment. No password is ever used.

verified_human=true will be asserted by the stub id_token, exercising the exact production verification path.