A refused browser-signed deploy says "the device" approved it#4017

A Server that enforces Device approval refuses a deploy approval signed by a browser key under a passkey's session grant with C1's Device wording (refusal_text in core/crates/ployzd/src/machine/local_machine/deploy_approval.rs): "The device approved a deploy to another environment." and "The device's approval expired. Deploy again." The signature refusal also names the browser key as "device ". Seen on a lab while verifying #4016 (C3), with the approval signed by a browser key.

Expected: name the approver the Server checked, a passkey or a Device.

F 3 (only browser-signed deploys, which arrive with B5), S 2 (wording only; the refusal itself is right).