Surfaced live: \`grounds login\` failed with
  device endpoint 400: {"error":"invalid_request",
  "error_description":"Missing parameter: code_challenge_method"}

Recent Keycloak versions enforce PKCE on the device-authorization
endpoint, but our DeviceClient was sending only client_id + scope.

Adds RFC 7636 PKCE:
- StartDevice generates a 256-bit URL-safe random verifier and the
  matching SHA-256 challenge, sends \`code_challenge\` +
  \`code_challenge_method=S256\` to /auth/device, and returns the
  verifier on the response struct.
- PollToken takes the verifier as a new positional arg and forwards
  it as \`code_verifier\` on each token-endpoint call so Keycloak
  can validate the challenge bound to the device_code at request
  time.
- login.go threads the verifier through.

Tests assert the new fields are sent on both endpoints.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>