v2.13.1

Supersedes v2.13.0, which was accidentally cut from main's prior tip before the release branch was promoted, and does not contain the change below.

Added

• OAuth device authorization grant (RFC 8628) — enables browser-less sign-in for CLIs and other input-constrained clients (BIND-0202).
  • IOAuthDeviceAuthorizationStore with an Azure Table backend. The Entity Framework backend gets an explicit not-implemented stub, so every other OAuth grant (authorization_code, refresh_token, client_credentials) keeps working unchanged for EF-backed deployments; only a device_code request against EF fails, with a clear error.
  • New /oauth/device_authorization and /oauth/device endpoints, and a device_code case in OAuthTokenService.ExchangeAsync.
  • OAuthClientRecord.DeviceVerificationUri — a per-client verification URL, alongside the existing RedirectUris.
  • OAuthConfiguredClientSeeder — idempotently syncs IBeam:Identity:OAuthServer:Clients config into whichever IOAuthClientStore is registered, so a first-party, cross-tenant client (e.g. a CLI) can be declared without going through the tenant-scoped client admin API.