Support opt-in S256 PKCE for device authorization

[ancongui]

Device authorization could not work with providers that require S256 PKCE: PyFly had no public way to send a challenge at authorization or its matching verifier during polling. Add authorize_device(..., use_pkce=True) to generate and retain a proof per client-owned grant and supply it automatically on every poll. Default request forms remain unchanged; no plain method or downgrade fallback is introduced. Prepare release 26.09.14.

Validation:

• Red/green protocol peer checks both PKCE legs, concurrent grants polled in reverse order, exact legacy forms, rejected ownership, secret reflection/redaction and cancellation/cleanup.
• The full local suite passes 7,790 tests (7 skipped, 2,573 deselected). The 60 final focused tests cover 59 OAuth cases, including three added while the full run was active, plus release metadata. Ruff, formatting, strict mypy, docs and book checks pass; independent review has no findings.
• Exact noneditable wheel verified on Python 3.12 and 3.13: all 784 Python files match source, base imports without HTTPX/Starlette, and public API probes pass with PKCE enabled and disabled using only the OAuth client extra. Network access is denied during probes.
• The reviewed local wheel is handed off before remote CI. Real provider/backend acceptance remains consumer-owned; this task does not modify its services or configuration.