Signing in from the coder is two logins wearing one name #129

The session says "Press Enter to log in with GitHub." and then opens
https://openagents.com/device. GitHub is an implementation detail of how
OpenAgents authenticates; the reader is logging in to OpenAgents. The message
should say so.

That is the small half. The real problem is that it is two logins.

What actually happens

/device is a LiveView inside live_session :authenticated
(router.ex:244), so it requires a signed-in browser session of its own. A
reader who is not signed in to openagents.com is bounced through that login
first, and only then reaches the device page — where they are asked to approve
a second thing, which does not visibly relate to the sign-in they just
completed. Two sign-ins, one intent, and nothing on screen connecting them.

Once approved, the code they were given by the terminal still has to be
matched. It works, but it reads as a coincidence rather than a flow.

What to build

One flow from the reader's side:

1. The session says "Press Enter to sign in to OpenAgents."
2. The link carries the code (/device?user_code=… already prefills — that
   part works and is why device approvals succeed in seconds where the
   Computers page's, which ignores its params, expire unapproved; see #112).
3. If the reader is not signed in, the sign-in they are sent through must
   return them to the device page with the code still in hand, so approving
   is the next click and not a fresh errand. That return path is the actual
   work here.
4. The page should name what is asking — the machine and the scopes — so
   approving is an informed act rather than a reflex.

Why it is worth doing properly

This is the first thing a new user does. It currently costs two logins, a code
transcription in the worst case, and a moment of "did that work?" — and the
terminal gives no sign of progress until --resume is run. A single flow that
ends with the session already authenticated is the difference between a product
and a procedure.

Related: #128 (there is no way to log out), #112 (the same prefill problem,
solved, on the Computers page).