Add device authorization flow for TV-app-style pairing (RFC 8628)

Implements RFC 8628-style device authorization so clients
(argosy-launcher, grout) can pair by display instead of manually
copying tokens. Device posts to an open /api/auth/device/init with
its identifier and requested scopes; the server returns device_code
+ user_code + QR URL. User scans QR, lands at /pair/device, approves
(optionally editing name/scopes/expiry); the device's next poll on
/api/auth/device/token returns a ClientToken bound 1:1 to a newly-
created (or deduped) Device record. Downstream endpoints
(/play-sessions, /sync/negotiate) infer device_id from the bound
token so the client doesn't have to ship it on every call.

- Migrations 0080/0081: devices.client_device_identifier (unique
  per user) and client_tokens.device_id FK (ON DELETE SET NULL)
- Five new endpoints under /api/auth/device (init/pending/approve/
  deny/token) with Redis-backed state, per-IP rate limits, and
  RFC-compliant error codes (authorization_pending, slow_down,
  expired_token, access_denied)
- HybridAuthBackend surfaces bound device_id on request.state and
  bumps devices.last_seen with a 5-minute debounce
- /api/users/me returns current_device_id for bound tokens so a
  device can identify itself from its token alone
- Frontend approval screen at /pair/device with editable scopes/
  name/expiry (defaults to Never), 3s auto-close countdown
- ClientApiTokens settings list shows bound-device chip
- 20 i18n keys added to all 17 locales; generated models updated
- 52 new tests across 13 classes; full suite 1334 passed

Planning and review assisted by Claude Code.

Author: tmgast

backend/alembic/versions/0080_devices_client_device_identifier.py

@@ -0,0 +1,36 @@
+"""Add client_device_identifier to devices
+
+Revision ID: 0080_devices_client_identifier
+Revises: 0079_add_rom_files_rom_id_index
+Create Date: 2026-04-24 00:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "0080_devices_client_identifier"
+down_revision = "0079_add_rom_files_rom_id_index"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("devices", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column("client_device_identifier", sa.String(length=255), nullable=True),
+            if_not_exists=True,
+        )
+        batch_op.create_index(
+            "ix_devices_user_client_identifier",
+            ["user_id", "client_device_identifier"],
+            unique=True,
+            if_not_exists=True,
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("devices", schema=None) as batch_op:
+        batch_op.drop_index("ix_devices_user_client_identifier", if_exists=True)
+        batch_op.drop_column("client_device_identifier", if_exists=True)

backend/alembic/versions/0081_client_tokens_device_id.py

@@ -0,0 +1,45 @@
+"""Add device_id FK to client_tokens
+
+Revision ID: 0081_client_tokens_device_id
+Revises: 0080_devices_client_identifier
+Create Date: 2026-04-24 00:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "0081_client_tokens_device_id"
+down_revision = "0080_devices_client_identifier"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("client_tokens", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column("device_id", sa.String(length=255), nullable=True),
+            if_not_exists=True,
+        )
+        batch_op.create_foreign_key(
+            "fk_client_tokens_device_id",
+            "devices",
+            ["device_id"],
+            ["id"],
+            ondelete="SET NULL",
+        )
+        batch_op.create_index(
+            "ix_client_tokens_device_id",
+            ["device_id"],
+            unique=False,
+            if_not_exists=True,
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("client_tokens", schema=None) as batch_op:
+        # Drop FK before the backing index -- MariaDB refuses otherwise
+        batch_op.drop_constraint("fk_client_tokens_device_id", type_="foreignkey")
+        batch_op.drop_index("ix_client_tokens_device_id", if_exists=True)
+        batch_op.drop_column("device_id", if_exists=True)