thv llm: support the OAuth device flow for headless and remote SSH boxes

[jerm-dro]

As a developer working on a remote or headless box
I want to authenticate to the LLM gateway with the OAuth device flow
So that I can log in without a local browser that can call back to localhost.

Why

thv llm token completes its OIDC login by having the browser redirect to a localhost callback. On a headless Linux box or over SSH there is no browser on the machine, so the flow cannot complete. The only route today is SSH localhost port forwarding, which is not discoverable and not automatable.

Raised twice last week during dogfooding:

• Headless box thread — "when running on a headless box, it expects that my browser can call back to localhost. But I'm not running a browser there. This whole codepath keeps giving me errors and is super frustrating… We should support the OAuth device flow for situations like this." The reporter ultimately abandoned thv llm and switched to a static API key.
• thv-dependency thread — the same friction framed as an argument for not requiring thv at all.

Notes

• Related but distinct: the same thread hit the secrets-provider requirement (no desktop keyring on a headless box, password prompt on every reboot). Worth a separate issue.
• thv llm token was built to never launch a browser flow in non-interactive mode (thv llm: OIDC token lifecycle and thv llm token command #5028); device flow gives that mode a way to actually succeed rather than just failing cleanly.
• thv llm setup --lazy (thv llm setup: add --lazy mode that defers OIDC login until first token use #5386) defers login for unattended provisioning, so device flow is the natural completion of that path.

[Sanskarzz]

@jerm-dro, I would like to work on this.