fix(gateway): show status for expired takeover links

[git-ksk]

Closes #200.

Change

The public OAuth gateway now converts only top-level Human takeover probe 404 / 410 outcomes into one generic, content-free terminal HTML surface:

• “Human takeover is unavailable or has expired”
• tells the Human to return to the requesting workflow for a fresh link
• GET returns the bounded page
• HEAD returns 200 with no body

Valid probes still enter the existing operator-login flow. Infrastructure/auth probe failures keep their existing status/response path. Takeover API and WebSocket behavior is unchanged.

Security / authority boundary

• unknown vs expired vs revoked is intentionally not distinguished publicly
• no session/intervention/principal identity is exposed
• no operator session is created/refreshed
• no Human authority is created or revived
• no private-core headers/body are reflected into the terminal page

Verification

• reference OAuth gateway: 44/44 pass
• root suite: 356 pass / 0 fail / 5 skip
• acceptance harness syntax checks: green
• typecheck: green
• build: green
• git diff --check: green

This is source hardening only and is intentionally not mixed into the immutable diagfull3ab57a3 acceptance image.