identity: device authorization grant (RFC 8628, +10 tests)

device.sx — for input-constrained devices. authorize → {device_code,
user_code}; the human approves/denies out-of-band by user_code; the device
polls by device_code through the §3.5 status machine (authorization_pending
→ access_denied / {ok, Token}). Device code is single-use once a token
issues; approve-after-deny is rejected. Tokens grant-backed via token.sx.
Device-code expiry + slow_down deferred (no wall clock). New
tests/device.sx. 168/168.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,7 +1,7 @@
 {
   "language": "identity",
-  "total_pass": 158,
-  "total": 158,
+  "total_pass": 168,
+  "total": 168,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":24,"total":24,"status":"ok"},
@@ -15,6 +15,7 @@
     {"name":"federation","pass":12,"total":12,"status":"ok"},
     {"name":"expiry","pass":8,"total":8,"status":"ok"},
     {"name":"clients","pass":11,"total":11,"status":"ok"},
-    {"name":"grants","pass":9,"total":9,"status":"ok"}
+    {"name":"grants","pass":9,"total":9,"status":"ok"},
+    {"name":"device","pass":10,"total":10,"status":"ok"}
   ]
 }