Add a confirm button so mail scanners can't consume magic links

Corporate mail scanners can fetch links in an email before the user clicks, which consumes a single-use magic-link token on GET. Have the emailed link render a page with one confirm button, and consume the token only on the resulting POST. This applies to browser sign-in and to terminal device-login approval. The design accepts one extra click in exchange for links that still work when the human opens them.