Device Authorization Endpoint

OAuth 2.0 Device Authorization Request (RFC 8628 §3.1/§3.2).

The CLI POSTs here to start a device flow. We mint a high-entropy device_code (stored only as sha256) plus a short human-typed user_code (stored RAW — it is low-entropy and must be looked up by the human, so its safety is single-use + rate-limit + a 600s TTL, not length). The CLI then polls /token while the human visits verification_uri on the portal.

There is NO redirect_uri (device flow has none). PKCE is OPTIONAL and, when supplied, is bound to the row and verified at /token — never at the portal.