Add device authorization flow (RFC 8628) for CLI login

Implements the device code grant flow so artdag CLI can authenticate
via browser approval. Includes device/authorize, device/token endpoints,
user code verification page, and approval confirmation template.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

account/templates/auth/device_approved.html

@@ -0,0 +1,9 @@
+{% extends "_types/root/_index.html" %}
+{% block meta %}{% endblock %}
+{% block title %}Device Authorized — Rose Ash{% endblock %}
+{% block content %}
+<div class="py-8 max-w-md mx-auto text-center">
+  <h1 class="text-2xl font-bold mb-4">Device authorized</h1>
+  <p class="text-stone-600">You can close this window and return to your terminal.</p>
+</div>
+{% endblock %}