Starts a device authorization, for a device or a command-line tool that cannot receive an OAuth redirect. Show the user the user_code and the verification_uri, and optionally the verification_uri_complete as a link or QR code. The user logs in to Proof, checks that the code on the page matches, and approves. Meanwhile, poll the token endpoint with the device_code grant every interval seconds: it answers authorization_pending until the user approves, then issues an access token and a refresh token with the agentic scope, or access_denied or expired_token.