fix: prevent expired OAuth device codes in authentication flow

[stephschofield]

Problem

The authentication system was creating new OAuth device auth instances on every /auth/check request, which caused several issues:

• Device codes only last 15 minutes per GitHub OAuth specification
• Each new /auth/check request created a different device code
• Frontend polling kept trying to verify expired codes instead of the original one
• Device authentication was not persisting - the auth instance was recreated on every check
• Users saw "expired token" errors when refreshing the auth page
• Already authenticated users had to re-authenticate unnecessarily

Root Cause

The checkDeviceFlowAuth() function was calling createOAuthDeviceAuth() on every poll, instead of reusing the original auth instance from login. Since device codes expire after 15 minutes, and a new code was generated on each check, the original code the user authorized would expire before verification could complete.

Solution

This PR implements proper OAuth instance lifecycle management to persist device authentication:

1. Store OAuth auth instance - Created once during initiateDeviceFlow() and stored in pendingAuth
2. Reuse for verification - checkDeviceFlowAuth() now reuses the stored instance instead of creating new ones
3. Early return for authenticated users - If tokens are valid, immediately return authenticated without device flow checks
4. Clear after success - Once authenticated, clear pendingAuth and pendingVerification
5. Graceful error handling - Expired device codes are caught and handled without throwing errors

Changes

src/services/auth-service.ts

• Added pendingAuth variable to store OAuth instance across requests
• Modified initiateDeviceFlow() to store and clear auth instance appropriately
• Updated checkDeviceFlowAuth() to reuse stored auth instance
• Enhanced error handling for expired codes
• Updated clearTokens() to clear pending auth state

src/types/github.ts

• Updated VerificationResponse type to support 'authenticated' status

Benefits

✅ Device authentication persists across polling requests
✅ Users stay authenticated on page refresh
✅ No more expired device code errors
✅ Single OAuth flow per login session
✅ Better error handling and logging
✅ Improved user experience with persistent authentication

Testing

• ✅ Build passes
• ✅ Lint passes
• ✅ Authentication flow works correctly
• ✅ Page refresh maintains authentication state
• ✅ Expired codes handled gracefully