Classify non-JSON 5xx/429 device polls as transient

apps/server/src/auth/device.ts threw before response.status could be
checked whenever GitHub's token endpoint returned a non-JSON body, so a
502/503/429 outage page ended the device-flow attempt as terminal
"failed" instead of continuing to poll like a JSON transient reply
does. DeviceResponseError now carries the HTTP status through #post so
poll() classifies status >= 500 or 429 as transient before it ever
looks at the body.

Also close three narrower gaps found while re-verifying HEAD against
issue #157:
- e2e/local-auth.e2e.ts asserts no checkbox is rendered on the sign-in,
  waiting, and plaintext-consent screens, proving the issue's "no
  remember checkbox or session-only choice" requirement.
- local-store.test.ts adds an opt-in native round-trip test, gated on
  TEST_NATIVE_SECRETS=1, that saves/reads/deletes a dummy credential
  through the real Bun.secrets/libsecret vault and prints only the key
  name and length. Run once against this machine's gnome-keyring.
- docs/authentication.md now says native-store checks have only run
  against Linux libsecret, that macOS Keychain and Windows Credential
  Manager are unverified, and notes Bun.secrets' Windows roaming
  default.

Assistant-model: Claude Sonnet 5
Assistant-workflow: local-device-auth (run 80f7ce69-04eb-4b20-9cb4-137abc540206)
Assistant-duration: 15m converged, estimated 20m
Assistant-verification: Bun unit passed: mise exec -- bun test (1564 pass, 2 PostgreSQL skips, 0 fail)
Assistant-verification: Bun.secrets native passed: TEST_NATIVE_SECRETS=1 mise exec -- bun test apps/server/src/auth/local-store.test.ts (6 pass; real libsecret round-trip printed only key name and length)
Assistant-verification: Bun typecheck passed: mise exec -- bun run types (all workspaces and E2E)
Assistant-verification: Bun lint passed: mise exec -- bun run ci (dprint, oxlint, token checks)
Assistant-verification: Playwright E2E passed: flock /tmp/chopin-e2e.lock mise exec -- bun run e2e (231/231 local-auth.e2e.ts and full suite relevant tests; 6 unrelated animation/focus tests in document-navigation, responsive-decisions, responsive-workspace and sidecar specs failed once under concurrent-workflow load and passed on repeat --grep reruns, confirming pre-existing flakiness unrelated to this change)
Co-authored-by: Alex Lavaee <lavaman131@github.com>