Device flow: replay-revocation, user_code CSPRNG, /device rate limit

More device-flow security-review fixes.

Replay-revocation on device_code redemption (was: destroy on use):
- Redemption now marks the code redeemed_at and links the issued access/refresh
  tokens back to it (new oidc_device_code_id FKs, on_delete: :nullify) instead of
  destroying the row. A replayed redeemed code is detected as reuse — revoking
  every descended token and returning a distinguishable "already been used"
  invalid_grant rather than the generic "Invalid device_code" — mirroring the
  authorization-code reuse semantics (RFC 6749 §4.1.2). The device_code FK is
  carried forward across refresh rotation so revocation reaches the whole chain.
  Redeemed codes are reaped by the existing expiry cleanup sweep.

user_code CSPRNG (RFC 8628 §6.1):
- The 8-char user_code is a credential (type it + Approve mints tokens), so draw
  it from SecureRandom instead of Ruby's global Mersenne Twister (Array#sample).

Rate-limit the /device verification endpoint (RFC 8628 §5.1):
- Add the app's standard 10/min limit on show + verify so a signed-in user can't
  brute-force the short code space to deny or hijack a pending authorization.

Also carried in this commit (other agent's working-tree change):
- Give each OidcController rate_limit a distinct name: so frequent device polling
  on the token endpoint no longer shares one counter with (and 429s) unrelated
  token/refresh/revoke/introspect calls.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie

app/controllers/device_authorizations_controller.rb

@@ -9,6 +9,14 @@
 class DeviceAuthorizationsController < ApplicationController
   # Browser form endpoint — keep CSRF protection on (do NOT skip it).
 
+  # RFC 8628 §5.1: rate-limit user_code entry so a signed-in user cannot brute
+  # force the short code space to deny or hijack another user's pending
+  # authorization during its ~10 minute window. Covers both the lookup (show) and
+  # the state-changing submit (verify).
+  rate_limit to: 10, within: 1.minute, only: [:show, :verify], with: -> {
+    render plain: "Too many attempts. Try again later.", status: :too_many_requests
+  }
+
   # GET /device?user_code=WDJB-MJHT
   def show
     @user_code = params[:user_code].to_s