Start a device client authorization

Starts the CLI flow, for clients that cannot receive a browser redirect. Public: the client has no credential yet.

Returns a device_code (which the client keeps and polls POST /v2/account/authorize/claim with) and a user_code the person types on the consent page. Poll no faster than interval seconds or the per-IP limit trips. Both expire in 10 minutes.

The consent page must state that the person should only type a code they just generated themselves — a code sent to them by someone else is the standard phishing shape of this flow (RFC 8628 §5.3).

As in the browser flow, the client sends only the SHA-256 of its PKCE verifier; the verifier itself never leaves the machine and is what proves ownership at redemption.