[ENG-3568] Point login at the approval page, not the API root

[mariojgt]

Pairs with patchstack/saas#1335, which adds the page this points at.

The bug

login printed:

Approve at: https://api.patchstack.com/activate

api.patchstack.com is the API origin, not the dashboard — and /activate already serves the team-seat "set a password" page. Following the link landed on an unrelated screen with nothing to approve, so the flow could not be completed.

The fix

-const verificationUri = `${new URL(base).origin}/activate`;
+const verificationUri = `${base}/device?code=${encodeURIComponent(userCode)}`;

The API redirects that to the dashboard SPA — the CLI only knows the API origin, and the page lives on the app. The code travels in the query, so following the link is a single confirmation rather than retyping it.

Approve at: …/monitor/pulse/device?code=DJ5J-RSBN
     └─ 302 ─▶ app.patchstack.com/connect?code=DJ5J-RSBN

Works from a logged-out browser too: the dashboard stores the full path through sign-in and returns to it with the code intact.

Verification

1213 tests pass, typecheck clean. The existing login test now asserts the redirect URL rather than the old one.

Merge after saas#1335 — until that deploys, the redirect target does not exist.

Ref ENG-3568

🤖 Generated with Claude Code

[coderbuds]

Login now directs users to the device approval page with clear single-click confirmation.

🎯 Quality: 84% Excellent · 📦 Size: Extra Large — strongly consider breaking this down

🛡️ Standards: no pre-flight fit check ran for this change — wire assess-change-fit into your coding agents to catch size before opening.

📈 This month: Your 56th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

/review