Fix 500 when deleting an application with device codes

Deleting an application left its oidc_device_codes orphaned, tripping the
FK constraint and raising SQLite3::ConstraintException. Unlike the other
child tables, oidc_device_codes had neither a dependent: :destroy
association nor an on_delete: :cascade FK, so any app that had started a
device-authorization flow could not be deleted (regardless of groups/users,
since a pending device code has a null user_id).

Add the missing has_many :oidc_device_codes, dependent: :destroy and a
migration to cascade at the DB level, mirroring application_user_claims.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LARKs4cVsGrvKCkKZhPcy6

db/migrate/20260719000006_add_cascade_to_oidc_device_codes_application_fk.rb

@@ -0,0 +1,14 @@
+class AddCascadeToOidcDeviceCodesApplicationFk < ActiveRecord::Migration[8.1]
+  # Deleting an application left its oidc_device_codes orphaned, tripping this
+  # FK and 500ing the destroy. Mirror application_user_claims: cascade at the DB
+  # level so the delete is safe even if the model-layer cascade is bypassed.
+  def up
+    remove_foreign_key :oidc_device_codes, :applications
+    add_foreign_key :oidc_device_codes, :applications, on_delete: :cascade
+  end
+
+  def down
+    remove_foreign_key :oidc_device_codes, :applications
+    add_foreign_key :oidc_device_codes, :applications
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_07_19_000005) do
+ActiveRecord::Schema[8.1].define(version: 2026_07_19_000006) do
   create_table "active_storage_attachments", force: :cascade do |t|
     t.bigint "blob_id", null: false
     t.datetime "created_at", null: false
@@ -329,7 +329,7 @@ ActiveRecord::Schema[8.1].define(version: 2026_07_19_000005) do
   add_foreign_key "oidc_access_tokens", "users"
   add_foreign_key "oidc_authorization_codes", "applications"
   add_foreign_key "oidc_authorization_codes", "users"
-  add_foreign_key "oidc_device_codes", "applications"
+  add_foreign_key "oidc_device_codes", "applications", on_delete: :cascade
   add_foreign_key "oidc_device_codes", "users"
   add_foreign_key "oidc_refresh_tokens", "applications"
   add_foreign_key "oidc_refresh_tokens", "oidc_access_tokens"