A device-authorization grant (RFC 8628 shape).
Two codes, two audiences: the high-entropy device_code (stored hashed)
stays on the machine that started the flow and is what the poller asks
with; the short user_code is what a human types into the host's approval
page. subject_id is null until a signed-in subject approves or denies,
and is stored in the column Managoat.OAuth.Migration names user_id by
default. Single use (used_at), fifteen minutes to live.