Connecting an origin, the device code and the authorize step, speaks the home page's language #9905

For: bringing repositories over from elsewhere reads as calm plain steps. The page a connect waits on (/settings/origins/flows/:id, src/web/pages/origin-flow.ts) still boxes the device code, the authorize step and the expired notice in card(.

Done looks like:

• [x] The page has one <h1>; the code to type and where to type it, the authorize link, and the expired notice with its start-again form are plain sections or one plain line, not boxes.
• [x] src/web/pages/origin-flow.ts no longer calls card(; the rendered page has no class="card" or card-body.
• [x] Coming back to the page still resumes where the connect was; the verification link keeps rel="noreferrer noopener"; the start-again form still posts to /settings/origins/oauth behind the same-origin check; no token is ever on the page.
• [x] A new test/origin-flow-language.test.ts asserts the above for a waiting device grant and an expired flow, and fails on main today; test/origin-flow-page.test.ts and test/origins-oauth-flows.test.ts still pass; bun scripts/design-lint.ts is clean.

Touch only src/web/pages/origin-flow.ts and the new test.

Reviewed pull #9908 at its head: ticked The page has one <h1>; the code to type and where to type it, the authorize link, and the expired notice with its start-again form are plain sections or one plain line, not boxes.; src/web/pages/origin-flow.ts no longer calls card(; the rendered page has no class="card" or card-body.; Coming back to the page still resumes where the connect was; the verification link keeps rel="noreferrer noopener"; the start-again form still posts to /settings/origins/oauth behind the same-origin check; no token is ever on the page.; A new test/origin-flow-language.test.ts asserts the above for a waiting device grant and an expired flow, and fails on main today; test/origin-flow-page.test.ts and test/origins-oauth-flows.test.ts still pass; bun scripts/design-lint.ts is clean..