Function approve_device 

async fn approve_device(
    conn: &mut PgConnection,
    user_code: &str,
    user_id: Uuid,
) -> Result<(), ControllerError>

Core of POST /device_verification/approve: persist consent (always, never short-circuited) then approve the pending grant, binding it to user_id.