fix(apps): device-flow poll stuck on 'Waiting for authorization'

GitHub's OAuth endpoints take form-encoded params; the JSON token request
produced an unrecognized error that fell through to 'pending' forever, so the
dialog never advanced after the user authorized.

- form-encode device/code and access_token requests
- unknown token-endpoint errors now fail loudly instead of spinning;
  incorrect_device_code maps to expired (restart offered)
- issued-token is remembered so a transient identity-fetch failure retries on
  the next poll instead of burning the consumed device code
- dialog catches hard poll failures and surfaces them

apps/x/apps/renderer/src/components/apps/publish-dialog.tsx

@@ -56,7 +56,12 @@ export function PublishDialog({ folder, appName, onClose, onPublished }: {
             setError(p.status === 'expired' ? 'The code expired — start again.' : 'Authorization was denied.')
             setPhase('auth')
           }
-        })()
+        })().catch((e: unknown) => {
+          // A hard failure (bad client config, network) must surface, not spin.
+          if (pollTimer.current) window.clearInterval(pollTimer.current)
+          setError(e instanceof Error ? e.message : String(e))
+          setPhase('auth')
+        })
       }, 5000)
     } catch (e) {
       setError(e instanceof Error ? e.message : String(e))