Fix device token handling

[tiankaima]

What changed

• make the CLI a pure OAuth API client by excluding unused openid, profile, and email identity scopes
• retain offline_access and all discovered API feature scopes
• accept standard OAuth token responses without requiring an id_token
• remove unused ID-token parsing and the go-jose dependency
• add an end-to-end device-flow regression covering discovery, registration, authorization, polling, and credential creation without an ID token

Root cause

The production RFC 8628 device token response correctly contains access/refresh tokens and granted scopes but no OIDC ID token. The CLI does not consume identity claims, yet it requested openid and rejected the otherwise valid OAuth response when id_token was absent. Its old parser also inspected ID-token claims without signature verification, so retaining that unused path provided no security value.

Impact

life-ustc account login --device now saves the issued OAuth credentials after approval. Browser login uses the same API/offline scope set and no longer depends on an unused OIDC response.

Validation

• full mocked device flow succeeds with no id_token
• production accepts the filtered 45-scope registration/device-authorization request
• go test ./internal/auth
• go test -race ./...
• go vet ./...
• golangci-lint run ./...
• OpenAPI provenance verification and generation
• go build -buildvcs=false -ldflags "-X github.com/Life-USTC/CLI/internal/cmd/root.version=dev" -o life-ustc ./cmd/life-ustc