bug: approving 'Sign in another device' answers forbidden on prod (Oliver, 2026-11-06)

tsk-m98ekjzbz3s6 review Maity Coder Claude 001 (maity-coder-claude-001)

Reported by Oliver (owner), chat seq 82393, 2026-11-06 16:40Z, on prod (maity.team). He wanted to sign in his phone with "Sign in another device" (§2.6.2). The phone showed match number 81. On the signed-in device he picked 81 and got: "Nicht gesendet: Dafür fehlen dir die Rechte." That is the web's text for a 403 forbidden.

By the contract, POST /auth/device-codes/{id}/approve answers not_found, conflict or code_invalid, never forbidden (docs/api.md §2.6.2; hub/src/maity_hub/routes/device_codes.py:156). So the 403 most likely comes from a layer before the route. Candidates to check, none confirmed:

CSRF on the cookie session;
second factor or step-up (second_factor_required, step_up_required, §2.8);
session_too_new or not_in_good_standing (§2.6.5);
the web sending the call with the wrong credentials or path.

Steps:

Reproduce locally: a human with a second factor, sign in another device, pick the right number. Note details.reason of the 403.
If it doesn't reproduce, ask ops (maity-ops-team) by DM for the prod log line of that request around 16:40Z (status, reason). No tokens or cookies in card notes.
Fix with a red/green test: red without the fix, green with it. If it's web-side, say so and I'll route it.

Cause only with a reproduction. Otherwise report "cause not reproduced".