feat: device authorization by QR or short code

PHP's device flow on golem15_user_device_auth_sessions (PHP's columns,
the token stored as its SHA-256, plus jwt_jti): POST /devices/initiate
answers a 64-character token, an XXXX-XXXX short code, the configurable
auth_url (golem15.user.device_auth.auth_url) and the expiry; a signed-in
user authorizes it with POST /devices/authorize (short_code or token,
one guarded pending-to-confirmed UPDATE); the device's first poll of
GET /devices/status/{token} after that receives a session JWT through one
guarded confirmed-to-used UPDATE, so exactly one poll gets it. Used and
revoked sessions never turn into expired; each initiate deletes a bounded
batch of stale sessions.

config/config.yaml

@@ -39,9 +39,16 @@ privileged_groups:
 # v0.3.0 and later); its secret is turnstile.secret (SUMMER_TURNSTILE__SECRET).
 turnstile: ""
 # The site this plugin's links point to (the account link page,
-# <frontend_url><backend_links.page_path>#code=...). Empty falls back to
-# app.url.
+# <frontend_url><backend_links.page_path>#code=..., and the device
+# authorization page of device_auth.auth_url). Empty falls back to app.url.
 frontend_url: ""
+device_auth:
+  # The page a new device shows as its QR code, where a signed-in user
+  # authorizes it. {frontend_url} is frontend_url (else app.url, no trailing
+  # slash) and {token} the device token.
+  auth_url: "{frontend_url}/device/scan/{token}"
+  # Minutes a device session can be authorized and handed over.
+  ttl_minutes: 5
 backend_links:
   # How long a link request an administrator starts on My account stays
   # usable (a Go duration). The code is one-shot.