Render an interstitial showing device hostname, OS, and machine-key fingerprint before finalising OIDC registration. The user must POST to /register/confirm/{auth_id} with a CSRF double-submit cookie. Removes the TODO at oidc.go:201.
