feat: device authorization by QR or short code

PHP's device flow on golem15_user_device_auth_sessions (PHP's columns,
the token stored as its SHA-256, plus jwt_jti): POST /devices/initiate
answers a 64-character token, an XXXX-XXXX short code, the configurable
auth_url (golem15.user.device_auth.auth_url) and the expiry; a signed-in
user authorizes it with POST /devices/authorize (short_code or token,
one guarded pending-to-confirmed UPDATE); the device's first poll of
GET /devices/status/{token} after that receives a session JWT through one
guarded confirmed-to-used UPDATE, so exactly one poll gets it. Used and
revoked sessions never turn into expired; each initiate deletes a bounded
batch of stale sessions.

updates/organisations_test.go

@@ -53,6 +53,7 @@ func TestCreateOrganisationsMigration(t *testing.T) {
 		"202610160002_add_handle_to_users",
 		"202610210001_add_users_email_verified_at",
 		"202610220001_create_golem15_user_backend_links",
+		"202610260001_create_device_auth_sessions",
 	}
 	if len(ids) != len(want) {
 		t.Fatalf("history = %v", ids)
@@ -63,9 +64,10 @@ func TestCreateOrganisationsMigration(t *testing.T) {
 		}
 	}
 
-	// Backend links, email proof, handle, OAuth identities, the three admin migrations, API tokens, user groups,
-	// jwt blacklist, throttle, extend-users, then organisations.
-	for range 13 {
+	// Device auth sessions (golem15_user_device_auth_sessions), backend links, email proof, handle, OAuth
+	// identities, the three admin migrations, API tokens, user groups, jwt blacklist, throttle, extend-users,
+	// then organisations.
+	for range 14 {
 		if err := m.RollbackLast(); err != nil {
 			t.Fatal(err)
 		}