feat(auth): GrantInfo — expose pending grant scopes + remaining TTL

The approve UI needs to show what a user code asks for and how long it
is valid; GrantInfo returns (scopes, secondsLeft, ok) without consuming
the grant (consumption stays one-shot in Token).

auth/device.go

@@ -144,6 +144,27 @@ func (f *DeviceFlow) Approve(userCode string, approver *Principal) error {
 	return nil
 }
 
+// GrantInfo returns what a pending grant's client asked for (scopes) and
+// how long the code is still valid (seconds). The approve UI shows both so
+// the admin consents to exactly what the companion app will get and knows
+// how long they have. Returns (nil, 0, false) for unknown/expired codes.
+func (f *DeviceFlow) GrantInfo(userCode string) (scopes []string, expiresIn int, ok bool) {
+	if f == nil {
+		return nil, 0, false
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	dc, ok := f.byCode[userCode]
+	if !ok {
+		return nil, 0, false
+	}
+	s, ok := f.pending[dc]
+	if !ok || f.now().After(s.expiresAt) {
+		return nil, 0, false
+	}
+	return append([]string(nil), s.requested...), int(s.expiresAt.Sub(f.now()) / time.Second), true
+}
+
 // RequestedScopes returns the scopes a pending grant's client asked for.
 // The approve UI shows them so the admin consents to exactly what the
 // companion app will get. Returns (nil, false) for unknown/expired codes.