Return artifact consent through registered POST callbacks

[tdurieux]

After owner consent, return the completion code to the callback registered for the signed intent's client and callback IDs. The optional authenticated handoff endpoint reloads the browser session before disclosure, and the page uses a native POST with an explicit CSP destination policy. Codes stay out of URLs and browser storage.

Stacks on #849. No startup activation or production configuration change. The review-side receiver still needs a same-origin authenticated continuation because the initial cross-site POST does not send its Strict session cookie.

Validation: 762 tests pass, 74 optional-fixture tests pending; 23 disposable MongoDB tests pass; 16 targeted registry/HTTP and 17 browser/page tests pass. TypeScript, lint and build pass. Chromium desktop/mobile POSTs and a CSP denial pass with no external requests, referrer, Strict cookie, overflow or accessibility violations. Local 100-replay binding median 2.20 ms, p95 2.69 ms; synthetic fixture, no provider traffic.