dev-auth: use form encoding for device start/poll, JSON for refresh

Verified end to end against users.k6n.net: device grant approved in a
browser, refresh token stored 0600, access token carries aud
[dev-console, https://otel.k6n.net].

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

otel-ui/src/dev/device-auth.ts

@@ -21,15 +21,16 @@ interface DeviceStart {
   interval?: number;
 }
 
-const post = (path: string, body: Record<string, string>) =>
+// RFC 8628 endpoints take form bodies; /device/refresh takes JSON.
+const post = (path: string, body: Record<string, string>, json = false) =>
   fetch(`/dev-auth${path}`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
+    headers: { "Content-Type": json ? "application/json" : "application/x-www-form-urlencoded" },
+    body: json ? JSON.stringify(body) : new URLSearchParams(body),
   });
 
 async function refresh(refreshToken: string): Promise<TokenResponse | null> {
-  const res = await post("/device/refresh", { client_id: CLIENT_ID, refresh_token: refreshToken });
+  const res = await post("/device/refresh", { refresh_token: refreshToken }, true);
   return res.ok ? ((await res.json()) as TokenResponse) : null;
 }