feat(auth): support OAuth device authorization

[huanghongbo-hhb]

Summary

• Add OAuth Device Authorization for Zadig CLI.

Main Changes

• Add device authorization, token exchange/refresh, and revocation endpoints.
• Issue short-lived CLI access tokens backed by revocable Redis sessions.
• Revoke sessions on password, MFA, and user deletion security changes.
• Keep OAuth credentials out of ext-authz request logs.

Compatibility

• Existing Web and API Tokens are unchanged; only cli_access tokens use OAuth session validation.

Test

• go test ./pkg/microservice/user/... -count=1; git diff --check
  Contact: huanghongbo@koderover.com

---

This change is