RFC 8628 §3.2 makes the device-authorization `interval` optional with a client-side default of 5 seconds. request_device_code required it, so a compliant AS that omitted it hit the malformed-response path and the flow could never complete. Fall back to 5s and cover it with a regression test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>