Device-login completion carrier

Defensive endpoint. The external-OIDC path is normally completed by the integration callback delegating to the device-login completer; if reached, redirects to the success page. PUBLIC.