feat(pair): authenticate the machine with an RFC 8628 device grant

[cvince]

capy pair now signs the machine in as itself rather than installing a session handed to it by the approving device.

What changes

The machine asks the service to start a device authorization, prints the user code and the identity provider's verification URL, polls for its own tokens, and installs them through the existing session writer. Credentials are issued to this machine for the CLI client, so its identity is a property of how it signed in, not of how the session reached it.

Both legs go through the service rather than the identity provider directly: the service owns the client id, so this binary cannot pass the wrong one, and provider traffic stays server-side where it can be network-restricted.

Polling

• interval and expires_in come from the authorize response and are authoritative, never hardcoded — the server is entitled to change them.
• slow_down widens the interval for the rest of the run, not just the next poll. That signal exists because the server will otherwise start rejecting us, so continuing at the old rate makes things worse.
• Outcomes are the RFC's coded values only. Nothing reads error_description, which is prose and free to be reworded.

The 200-without-tokens trap

A waiting poll is also HTTP 200 — the loop needs that to keep polling. So a caller trusting the status code would read "still waiting" as "signed in", install nothing, and report success.

Success is therefore asserted from the tokens being present, never from the status code and never from the discriminator alone. Two tests hold it: a complete-looking body with no credentials must throw, and a pending 200 must produce no session and keep polling. Mutation-checked — removing the guard fails the first, so it isn't vacuous.

What deliberately does not change

The key-material half. A machine running capy pair has no browser — that is the whole reason the command exists — so the ceremony still runs on the human's own device through the broker transport, and K_local is still never written to disk. The only difference is that it now runs over a session belonging to this machine.

Notes for review

• Both let bindings in this command are gone: the ceremony and the session install each became a const holding a discriminated result from an extracted function, rather than a binding reassigned inside try/catch.
• Time and fetch are injected in the tests, so the poll loop is asserted deterministically and instantly.
• The suite exercises the BUILT binary. An unbuilt worktree fails ~50 unrelated tests (capy run, binary pinning) that have nothing to do with this change — run npx tsc first.

Full suite: 1790 pass, 0 fail.