fix(apps): pace device-flow polls in core — slow_down made auth spin forever

GitHub rate-limits the device-code token endpoint: a poll arriving even
slightly under the flow interval returns slow_down and permanently raises
the required interval. The renderer polled on a fixed 5s timer (exactly
the limit), so one jittery request tripped slow_down and every poll after
it was 'too fast' — GitHub answered slow_down forever and the dialog sat
on 'Waiting for authorization' even after the user approved.

Core now tracks lastTokenPollAt and skips the request until the flow's
current interval (base +1s margin) has elapsed, so slow_down bumps take
effect and the flow recovers. The renderer timer is just a heartbeat (2s).

apps/x/apps/renderer/src/components/apps/publish-dialog.tsx

@@ -62,7 +62,9 @@ export function PublishDialog({ folder, appName, onClose, onPublished }: {
           setError(e instanceof Error ? e.message : String(e))
           setPhase('auth')
         })
-      }, 5000)
+        // Heartbeat only — core paces the actual GitHub requests to the
+        // flow's required interval (and skips the request when it's too soon).
+      }, 2000)
     } catch (e) {
       setError(e instanceof Error ? e.message : String(e))
     }