[Ticket]: remaining server-rendered HTML — migrate end_session pages; record claim_redeem + check-session iframe as exceptions

### Type

Refactor

### Summary

After the RP/device-leg cutover (#607: `relying_party.rs` renders zero HTML), three server-rendered HTML surfaces deliberately remain in this repo. This ticket tracks their disposition so "Rust doesn't own the HTML" stays an honest claim with named exceptions rather than an overclaim.

### Intent

Finish (or explicitly bound) the human-plane migration: each remaining surface either moves to the `apps/authz-ui` SPA (converse-frontends) or is recorded as a permanent, justified exception.

### Source of truth (links)

- #607 / #598 / ADR-0029 (+ Update block) — the cutover this follows.
- #478 — the /ui human-plane epic (login chooser, success page) whose patterns (303 handoff + cookie-bound context endpoint + route allowlist entry) these migrations should reuse.

### Current Behavior

Three HTML producers remain (audited in #607's planning, file:line as of that branch):

1. `end_session.rs` — two pages via the shared `html_page.rs` shell (logout confirmation/result). **Migratable**: no secrets, same shape as the device pages.
2. `claim_redeem.rs` — five pages via `html_page.rs`, one of which displays a plaintext API key secret under a deliberately script-free CSP (`default-src 'none'; style-src 'unsafe-inline'`). **Not migratable without a security regression**: an SPA version requires an endpoint returning the secret as JSON to JavaScript. Any move needs its own ADR weighing that trade.
3. `session_management.rs` — the OIDC Session Management 1.0 `check_session_iframe`. **Never moves**: a protocol artifact addressed by machines, requiring `frame-ancestors *` + inline script — the exact inverse of the SPA's CSP posture.

### Expected Behavior

- `end_session.rs`'s pages migrated to SPA routes (new `route-table.ts` entries + page stories first, per the pages-in-Storybook-first rule), following the #607 pattern — OR a recorded decision to keep them.
- `claim_redeem.rs`: an ADR either accepting the permanent exception (recommended: the script-free posture is the security feature) or designing a safe migration.
- `check_session_iframe`: one sentence in ADR-0029 (or its successor) recording it as a permanent protocol exception, so a future "zero HTML" sweep doesn't naively move it.

### Acceptance Criteria

- [ ] Each of the three surfaces has either a merged migration or a recorded decision (ADR/comment) naming why it stays.
- [ ] `grep -rln "Html(\|html_page" crates/` output matches exactly the recorded exception list.
- [ ] Any migrated route follows the full #607 pattern: manifest entry, `idp_it.py` positive assertion, stage-authz-ui grep, redirect-target test.

### Out of Scope

- #478's SSO chooser (`/ui/login`) and provider registry — separate epic scope.

### Technical Context

The #607 pattern to copy: sections + full-page stories in converse-frontends → route in `route-table.ts` (manifest auto-includes) → pin bump + Rust 303 handoff in one atomic PR (ADR-0029's rollback-unit rule).

### Risks

`claim_redeem`'s secret page is the one place where "migrate everything" is actively harmful — the ticket exists partly to prevent an eager future sweep from doing exactly that.

### Test Plan

Per-surface, on migration: the flipped/new tests per the #607 pattern; the grep acceptance criterion is the standing audit.