Magic-link landing needs a confirm button against scanners

Corporate mail scanners prefetch links in email, so a single-use token consumed on GET can be burned before the human clicks. Have the GET render a page with a confirm button and consume the token only on the POST. This matters most for a CLI device-style login, where the page should also state what is being approved, e.g. 'Sign in your terminal as x@y?', because the approval hands a credential to a waiting terminal.