refactor(gateway): share device authorization HTTP requests

[marius-kilocode]

What Problem This Solves

The legacy and TUI device-auth flows duplicate the same initiation POST and polling GET logic.

Why This Change Was Made

Move only the identical HTTP functions into an internal auth helper. Keep both public entrypoints and their browser, progress, callback, credential, and organization-selection behavior unchanged. No new public exports, dependencies, retries, or validation.

User Impact

No intended behavior change. Request shapes, initiation 429 text, polling 202/403/410 mappings, generic errors, JSON passthrough, and network/JSON failures are preserved.

Evidence

• Production: 49 added / 112 removed, net 63 fewer lines across three source files. Focused tests add 35 lines; the verified allowlist entry removes 9. Entire PR: net 37 fewer lines.
• Fresh duplication report: 35 to 34 pairs, 684 to 629 duplicated lines, 4688 to 4494 duplicated tokens. Only fingerprint e6ac9a2221c1deb4 removed; ratchet passes.
• 10 focused helper/profile tests pass. Gateway and CLI consumer typechecks pass after installing worktree-local locked dependencies. Scoped lint has zero errors and three existing/moved production warnings; formatting and diff checks pass.
• Isolated loopback HTTP 429 smoke test exercised both real callers and confirmed the exact error without credentials, browser opening, or real authentication. The legacy spinner remained active after rejection until the test process timed out, an existing behavior left out of scope. The local server was stopped and temporary HOME/XDG profile removed. Full browser authentication was intentionally not exercised.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (5 files)

• packages/kilo-gateway/src/auth/device.ts
• packages/kilo-gateway/src/auth/device-auth.ts
• packages/kilo-gateway/src/auth/device-auth-tui.ts
• packages/kilo-gateway/test/auth/device.test.ts
• script/kilocode-duplication-allowlist.json

Previous Review Summary (commit 149eeca)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 149eeca)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (5 files)

• packages/kilo-gateway/src/auth/device.ts
• packages/kilo-gateway/src/auth/device-auth.ts
• packages/kilo-gateway/src/auth/device-auth-tui.ts
• packages/kilo-gateway/test/auth/device.test.ts
• script/kilocode-duplication-allowlist.json

---

_{Reviewed by grok-4.6 · Input: 111.1K · Output: 6.4K · Cached: 128.3K}

_{Review guidance: REVIEW.md from base branch main}