Cap device-code poll interval and sweep expired device codes

Two more fixes from the device-flow security review:

slow_down interval grew without bound (OidcController):
- Each too-fast poll bumped the persisted interval by 5s with no ceiling, so a
  client polling slightly fast — or an attacker spamming a known device_code —
  could balloon it (5→10→15→…) past the 10-minute expiry and starve a legitimate
  client of its token. Clamp the bump to OidcDeviceCode::MAX_INTERVAL (30s); a
  client polling at the advertised interval is never throttled.

Expired device codes accumulated forever (OidcTokenCleanupJob):
- Anonymous callers can create device codes via /oauth/device_authorization, and
  expired/denied/abandoned rows were never reaped. Sweep rows past expiry (with a
  1-hour grace to stay clear of in-flight redemption); redeemed codes are already
  destroyed at token issuance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie

app/models/oidc_device_code.rb

@@ -17,6 +17,14 @@ class OidcDeviceCode < ApplicationRecord
 
   STATUSES = %w[pending approved denied].freeze
 
+  # Polling interval, in seconds. The token endpoint bumps the persisted interval
+  # by INTERVAL_INCREMENT on each too-fast poll (RFC 8628 §3.5 slow_down), but
+  # clamps it to MAX_INTERVAL so a client polling slightly fast — or an attacker
+  # spamming a known device_code — can't balloon it past the expiry window and
+  # starve a well-behaved client of its token.
+  INTERVAL_INCREMENT = 5
+  MAX_INTERVAL = 30
+
   attr_accessor :plaintext_device_code
 
   before_validation :generate_device_code, on: :create