pollDevice

Polls until the user approves (RFC 8628 §3.5): waits on authorization_pending, backs off 5s on slow_down, fails on access_denied / expired_token or when the code expires.