feat: add rate limiting to POST /auth/device endpoint

[rorybyrne]

Summary

The POST /auth/device endpoint currently has no rate limiting. Each call creates a new device_authorizations row. Without rate limiting, an attacker could flood the table with pending device authorizations.

The 15-minute expiry and periodic cleanup mitigate this somewhat, but rate limiting at the endpoint level would be a proper defense.

Suggested approach

• Add per-IP rate limiting (e.g., 10 requests/minute) to POST /auth/device
• Consider also rate limiting POST /auth/device/token (polling endpoint)
• Could use a middleware-based approach or FastAPI dependency

Context

Identified during code review of #81 (OAuth Device Flow).