AUTH4D-121 Device authorization in discovery

GET /t/{tenantId}/.well-known/openid-configuration now advertises device authorization (RFC 8628 §4) so clients no longer need to hard-code the path:

• device_authorization_endpoint is {AUTH_ORIGIN}/device/authorization?tenant_id={tenantId}, the existing route from AUTH4D-16 (repository file docs/api-spec/auth4d-16.md). It uses the issuer origin and carries the tenant in the tenant_id query parameter, like the other protocol endpoints.
• grant_types_supported adds urn:ietf:params:oauth:grant-type:device_code after authorization_code and refresh_token. Polling still uses token_endpoint.

The document matches OidcDiscoveryDocumentSchema in packages/contracts, which already listed both fields.

Unchanged

• The device routes themselves, their request and response shapes and their CORS policy.
• Discovery CORS from AUTH4D-85 (repository file docs/api-spec/auth4d-85.md): public, wildcard, no credentials.
• The browser SDK ignores the new fields. The server SDK does not read discovery. The Unity package keeps using the fixed path, which is the same address discovery publishes.