OAuth hosted login: view sealed enrollment recovery codes (WebAuthn fetch-flow seam)

Server-renders the one-shot recovery-codes page from a sealed codes_token. This is the seam for the WebAuthn enroll-verify fetch flow, which cannot render the codes page itself, so it seals the codes plus OAuth-resume context and navigates here; the unseal also produces the acknowledgement envelope used by the subsequent codes-ack POST. Renders an expired-session error page when the token is missing or stale.