Device authorization grant: sondeo del dispositivo (RFC 8628 §3.4)

Sondea con el device_code. authorization_pending / slow_down / access_denied / expired_token como errores OAuth (400). Aprobado: access JWT (cred=device) + refresh opaco de dec-0113, una sola vez.

curl -X POST "https://example.com/auth/device/token" \  -H "Content-Type: application/json" \  -d '{    "client_id": "string",    "device_code": "string",    "grant_type": "urn:ietf:params:oauth:grant-type:device_code"  }'

{  "access_token": "string",  "expires_in": 1,  "refresh_token": "string",  "scope": "string",  "token_type": "Bearer"}