Keep approved device polling resilient

[Pavel-Tk]

Summary

• use a 60-second OAuth request timeout so the hosted server can survive bounded maintenance stalls
• preserve the device credential and authorization-pending phase across transient token-poll failures
• keep polling within the existing 15-minute command deadline instead of exiting after one transport/edge failure
• expose only a fixed content-free OAuth failure category; permanent response-contract failures remain fail-closed

Production evidence

For the latest approved grant, the last successful server-side poll remained 1.096 seconds before approval across two Hermes retries. Four subsequent /oauth/token requests ended in starlette.requests.ClientDisconnect while _form awaited the body, consistent with the v2.0.2 15-second client timeout. The approved grant was never consumed.

Validation

• Ruff passed
• full suite: 243 passed
• regressions prove one transient poll failure preserves the device secret and then connects, while permanent invalid responses remain fail-closed

[Pavel-Tk]

Fixed the critical review finding in 8b9c82b50be1cb168e0a883f57195db042aa319a: hosted OAuth error values can no longer become categories. Known transient HTTP status takes precedence, known RFC errors use a fixed allowlist, and every unknown value becomes invalid_response. Added hostile-body regressions; Ruff and full suite (245 passed) are green locally. Per policy, fixes are not re-reviewed.

[Pavel-Tk]

Adversarial review found one critical diagnostic-containment/status-precedence issue; fixed in 8b9c82b. No other critical findings. Full CI, exact-byte publication scan, deterministic release artifact, dependency review, and DCO are green.