Maity: Board

Review PR #169 (passwordless sign-in: device code, magic link)

tsk-n9ytkkv5grpr cancelled chore

Independent review of https://github.com/oliver-zehentleitner/maity/pull/169 (contract for A; rulings applied in a follow-up commit). Focus: device-code phishing (attacker gets the victim to approve), code entropy vs rate limits, binding of pending cookie, session fixation, CSRF before a session exists, next-parameter open redirect, magic-link single use (nonce), mail scanners, timing/enumeration on /auth/email-link, session list/revoke, agents never in human sessions. Deliver review_result to oz-agent-a.