fix!: support opt-in PKCE for device-code login (#4747)

## Problem and change
Some Keycloak client policies require S256 PKCE during device-code
login. Sending those parameters unconditionally breaks interoperability
with providers that expect standard RFC 8628 requests.

Configure device login with `OAuthFlow::DeviceCode(DeviceCodeOptions)`,
following the existing authorization-code options pattern.
`DeviceCodeOptions::new()` keeps PKCE disabled; `.use_pkce(true)` sends
an S256 challenge during device authorization and its matching verifier
during token polling. There is no automatic downgrade, and enabling PKCE
preserves the existing token-cache identity. Python, Node, and CLI
conversions retain ordinary device login without PKCE.

OIDC discovery and token requests now include a versioned User-Agent.
`env!("CARGO_PKG_VERSION")` is expanded at compile time and embeds the
version in the binary; no Cargo environment variable is needed when
running an installed binary or native binding.

The supported-flows guide documents the Rust-only device PKCE option and
its default.

## Rust API migration
BREAKING CHANGE: `OAuthFlow::DeviceCode` now carries
`DeviceCodeOptions`. Replace construction with
`OAuthFlow::DeviceCode(DeviceCodeOptions::new())` or
`OAuthFlow::DeviceCode(Default::default())`, and match with
`OAuthFlow::DeviceCode(_)`. Import `DeviceCodeOptions` from
`lancedb::remote` to opt into PKCE. Python and TypeScript public APIs
are unchanged.

## Validation
- `cargo +1.97.1 test --locked -p lancedb --features remote --lib
remote::`: 679 passed, including PKCE-on/off polling, option defaults,
User-Agent headers, and cache identity.
- `cargo +1.97.1 test --locked -p lancedb-python -p lancedb-nodejs --lib
test_device_code_conversion`: both native-binding conversion tests
passed.
- `cargo +1.97.1 test --locked -p lancedb --features remote --doc
remote::`: 6 passed, including the new options example and updated
session examples.
- `cargo +1.97.1 test --locked -p lancedb-cli --lib auth::tests::`: 11
passed.
- `cargo +1.97.1 fmt --all -- --check` and `git diff --check`: passed.
- A compiled version-string check ran successfully with
`CARGO_PKG_VERSION` unset at runtime.

---------

Co-authored-by: Ryan Haynes <ryan.haynes@lancedb.com>

docs/web/enterprise/authentication.mdx

@@ -98,7 +98,7 @@ client acquires tokens:
 | --- | --- | --- | --- | --- |
 | Client Credentials | `OAuthFlowType.CLIENT_CREDENTIALS` | `OAuthFlowType.ClientCredentials` | `OAuthFlow::ClientCredentials` | Service-to-service / machine-to-machine. Requires a client ID and client secret registered with your identity provider. |
 | Authorization Code | `OAuthFlowType.AUTHORIZATION_CODE` | `OAuthFlowType.AuthorizationCode` | `OAuthFlow::AuthorizationCode(AuthorizationCodeOptions::new())` | Interactive user sign-in through a browser and local callback server. Uses S256 PKCE by default. |
-| Device Code | `OAuthFlowType.DEVICE_CODE` | `OAuthFlowType.DeviceCode` | `OAuthFlow::DeviceCode` | CLI or headless sign-in. The client displays a verification URL and user code for the user to enter on another device. |
+| Device Code | `OAuthFlowType.DEVICE_CODE` | `OAuthFlowType.DeviceCode` | `OAuthFlow::DeviceCode(DeviceCodeOptions::new())` | CLI or headless sign-in. The client displays a verification URL and user code for the user to enter on another device. |
 | Azure Managed Identity | `OAuthFlowType.AZURE_MANAGED_IDENTITY` | `OAuthFlowType.AzureManagedIdentity` | `OAuthFlow::AzureManagedIdentity { client_id: None }` | Azure workloads with access to the IMDS endpoint. Tokens are fetched from IMDS, so no client secret is stored on the client. |
 
 ### Configure OAuth {#configure-oauth}
@@ -290,7 +290,7 @@ const db = await lancedb.connect("db://your-database-uri", {
 ```rust Rust icon="rust"
 use lancedb::remote::{AuthorizationCodeOptions, OAuthConfig, OAuthFlow, TokenCacheOptions};
 
-// Use OAuthFlow::DeviceCode for a CLI without a local browser or callback server.
+// Use OAuthFlow::DeviceCode(Default::default()) for a CLI without a local browser or callback server.
 let oauth_config = OAuthConfig {
     issuer_url: "https://your-issuer.example.com".into(),
     client_id: "your-public-client-id".into(),
@@ -317,9 +317,16 @@ let db = lancedb::connect("db://your-database-uri")
 ```
 </CodeGroup>
 
-With `DEVICE_CODE` / `DeviceCode` / `OAuthFlow::DeviceCode`, the same
+With `DEVICE_CODE` / `DeviceCode` / `OAuthFlow::DeviceCode(DeviceCodeOptions::new())`, the same
 configuration and connection calls apply; only the `flow` value changes.
 
+Device Code sends no PKCE parameters by default. For a provider that requires
+S256 PKCE on device grants, Rust callers can select
+`OAuthFlow::DeviceCode(DeviceCodeOptions::new().use_pkce(true))` (import
+`DeviceCodeOptions` from `lancedb::remote`). This option is currently Rust-only.
+Enable it only when the provider supports the extension; a failed PKCE request
+is not retried without PKCE.
+
 ### Reuse an interactive session {#reuse-an-interactive-session}
 
 By default, tokens stay in process memory. Set `token_cache` / `tokenCache`
@@ -379,7 +386,8 @@ Credentials and rejected for Azure Managed Identity.
 
 ### Configuration reference {#configuration-reference}
 
-The same configuration is available in all three SDKs. Python and Rust use
+The shared configuration below is available in all three SDKs; device-code PKCE
+is a Rust-only option through `DeviceCodeOptions`. Python and Rust use
 `snake_case` field names; TypeScript uses `camelCase`. In Rust, set optional
 `OAuthConfig` fields to `Some(value)` or `None`. Configure `redirect_uri`,
 `callback_port`, and `use_pkce` through the builder methods on