Add OAuth 2.0 device authorization grant (RFC 8628)

[mohnjiles]

Summary

Adds a fourth OAuth 2.0 grant type: the device authorization flow ("device flow"). The provider hands out a short user code, LitePost shows it with a copy button, opens the verification page in the browser, and polls the token endpoint until the sign-in is approved — no redirect URI to register, no localhost callback. Requested by ionite for quicker testing against real providers.

• New oauth2_device_flow Rust command: requests the device code, reports the user code to the UI via a flow-scoped oauth-device-prompt-{id} event, opens the browser (preferring verification_uri_complete so the code arrives pre-filled), and polls. Reuses the PendingOAuthFlows watch channel so the existing Cancel button works unchanged.
• Poll state is decided by the response body, not the HTTP status: GitHub answers authorization_pending with 200 + form encoding where the RFC says 400 + JSON. slow_down backs off 5s per the RFC; the provider''s expires_in bounds the wait (capped at 30 min).
• Accepts Google''s verification_url spelling alongside the RFC''s verification_uri.
• Device prompt renders from the flow store, so the sign-in survives tab switches like the authorization code flow does.
• OIDC discovery auto-fills the new Device Authorization URL field from device_authorization_endpoint.
• client_secret is sent on both the device authorization request and token polls when configured, for confidential clients (e.g. OpenIddict apps that require it).
• Docs: new Device Code section in docs/authentication.md.

Also bumps the version to 0.4.0 (all four spots + Cargo.lock).

Test plan

• cargo test — 24/24, including new parser tests for device authorization responses (JSON/form/Google spelling/defaults) and poll outcomes (pending/slow_down/denied/token, GitHub 200-form quirk)
• npx vitest run — 422/422, including a new component suite covering the device fields, scoped prompt event, cancel-by-flow-id, and token storage
• npx tsc --noEmit clean; clippy warnings are pre-existing (http_client.rs)
• Manually verified against a real OpenIddict IdP (JT) — token issued end to end
• UI verified in dev server: grant dropdown, device fields, no callback/PKCE controls for this grant

🤖 Generated with Claude Code