identity: device authorization grant (RFC 8628, +10 tests)

device.sx — for input-constrained devices. authorize → {device_code,
user_code}; the human approves/denies out-of-band by user_code; the device
polls by device_code through the §3.5 status machine (authorization_pending
→ access_denied / {ok, Token}). Device code is single-use once a token
issues; approve-after-deny is rejected. Tokens grant-backed via token.sx.
Device-code expiry + slow_down deferred (no wall clock). New
tests/device.sx. 168/168.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 158 / 158 tests passing**
+**Total: 168 / 168 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -17,6 +17,7 @@
 | ✅ | expiry | 8 | 8 |
 | ✅ | clients | 11 | 11 |
 | ✅ | grants | 9 | 9 |
+| ✅ | device | 10 | 10 |
 
 
 Generated by `lib/identity/conformance.sh`.