Cap device-code poll interval and sweep expired device codes

Two more fixes from the device-flow security review:

slow_down interval grew without bound (OidcController):
- Each too-fast poll bumped the persisted interval by 5s with no ceiling, so a
  client polling slightly fast — or an attacker spamming a known device_code —
  could balloon it (5→10→15→…) past the 10-minute expiry and starve a legitimate
  client of its token. Clamp the bump to OidcDeviceCode::MAX_INTERVAL (30s); a
  client polling at the advertised interval is never throttled.

Expired device codes accumulated forever (OidcTokenCleanupJob):
- Anonymous callers can create device codes via /oauth/device_authorization, and
  expired/denied/abandoned rows were never reaped. Sweep rows past expiry (with a
  1-hour grace to stay clear of in-flight redemption); redeemed codes are already
  destroyed at token issuance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie

app/jobs/oidc_token_cleanup_job.rb

@@ -25,5 +25,15 @@ class OidcTokenCleanupJob < ApplicationJob
     old_auth_codes = OidcAuthorizationCode.where("created_at < ?", 7.days.ago)
     deleted_count = old_auth_codes.delete_all
     Rails.logger.info "OIDC Token Cleanup: Deleted #{deleted_count} old authorization codes"
+
+    # Delete expired device codes (RFC 8628). They have a ~10 minute TTL and no
+    # audit value; a redeemed code is already destroyed at token issuance. Once
+    # expired a code can never be redeemed, so this single expiry sweep clears the
+    # expired, denied, and abandoned rows that would otherwise accumulate forever
+    # (anonymous callers can create them via /oauth/device_authorization). The
+    # short grace keeps this clear of any in-flight redemption near expiry.
+    expired_device_codes = OidcDeviceCode.where("expires_at < ?", 1.hour.ago)
+    deleted_count = expired_device_codes.delete_all
+    Rails.logger.info "OIDC Token Cleanup: Deleted #{deleted_count} expired device codes"
   end
 end