feat(kiro): 支持 AWS SSO OIDC 设备授权流程

为 Kiro provider 新增 Device Authorization 模式，替代原先禁用 OAuth 的限制:
- 后端实现 device-authorize / device-poll 端点，完成客户端注册、设备码签发、token 轮询和自动建 Key
- 前端 OAuthAccountDialog 新增设备授权 UI，支持 Start URL/Region 输入、验证链接跳转、倒计时和自动轮询

frontend/src/api/endpoints/provider_oauth.ts

@@ -55,3 +55,48 @@ export async function importProviderRefreshToken(
   const resp = await client.post(`/api/admin/provider-oauth/providers/${providerId}/import-refresh-token`, data)
   return resp.data
 }
+
+// Device Authorization (AWS SSO OIDC)
+
+export interface DeviceAuthorizeRequest {
+  start_url?: string
+  region?: string
+  proxy_node_id?: string
+}
+
+export interface DeviceAuthorizeResponse {
+  session_id: string
+  user_code: string
+  verification_uri: string
+  verification_uri_complete: string
+  expires_in: number
+  interval: number
+}
+
+export interface DevicePollRequest {
+  session_id: string
+}
+
+export interface DevicePollResponse {
+  status: 'pending' | 'authorized' | 'slow_down' | 'expired' | 'error'
+  key_id?: string
+  email?: string
+  error?: string
+  replaced?: boolean
+}
+
+export async function startDeviceAuthorize(
+  providerId: string,
+  data: DeviceAuthorizeRequest
+): Promise<DeviceAuthorizeResponse> {
+  const resp = await client.post(`/api/admin/provider-oauth/providers/${providerId}/device-authorize`, data)
+  return resp.data
+}
+
+export async function pollDeviceAuthorize(
+  providerId: string,
+  data: DevicePollRequest
+): Promise<DevicePollResponse> {
+  const resp = await client.post(`/api/admin/provider-oauth/providers/${providerId}/device-poll`, data)
+  return resp.data
+}