[Feature]: Return client errors from magic-link polling instead of 500s

[Bccorb]

Problem statement

/magic-link/check currently returns 500 { error: "Invalid request" } for missing tokens and device mismatches, which should be treated as client or auth state errors, not server failures.

Proposed solution

Choose correct 400/401/404 semantics, align route schemas, and add integration coverage.

Alternatives considered

No response

Impact area

Developer experience