Fix 500 when deleting an application with device codes

Deleting an application left its oidc_device_codes orphaned, tripping the
FK constraint and raising SQLite3::ConstraintException. Unlike the other
child tables, oidc_device_codes had neither a dependent: :destroy
association nor an on_delete: :cascade FK, so any app that had started a
device-authorization flow could not be deleted (regardless of groups/users,
since a pending device code has a null user_id).

Add the missing has_many :oidc_device_codes, dependent: :destroy and a
migration to cascade at the DB level, mirroring application_user_claims.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LARKs4cVsGrvKCkKZhPcy6

test/models/application_test.rb

@@ -81,4 +81,14 @@ class ApplicationTest < ActiveSupport::TestCase
 
     assert app.valid?, app.errors.full_messages.to_sentence
   end
+
+  test "destroying an application with a pending device code succeeds (regression for FK 500)" do
+    app = applications(:kavita_app)
+    device_code = app.oidc_device_codes.create!
+
+    assert_difference("OidcDeviceCode.count", -1) do
+      assert_nothing_raised { app.destroy }
+    end
+    refute OidcDeviceCode.exists?(device_code.id)
+  end
 end