Synapse is not spec compliant when using OAuth 2.0 API for POST /_matrix/client/v3/devices and DELETE /_matrix/client/v3/devices/{deviceId} and POST /_matrix/client/v3/account/deactivate endpoints

This issue was reported in https://github.com/element-hq/synapse/issues/18466 and https://github.com/element-hq/matrix-authentication-service/issues/4729 and https://github.com/matrix-org/matrix-spec-proposals/pull/3824#issuecomment-3009047461.

The purpose of this present issue is to provide an authoritative place to track this.

The spec notes for the [each](https://spec.matrix.org/v1.15/client-server-api/#post_matrixclientv3delete_devices) device deletion [endpoint](https://spec.matrix.org/v1.15/client-server-api/#delete_matrixclientv3devicesdeviceid):

> WARNING: Since this endpoint uses User-Interactive Authentication, it cannot be used when the access token was obtained via the [OAuth 2.0 API](https://spec.matrix.org/v1.15/client-server-api/#oauth-20-api).

However, if MAS is [enabled](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#matrix_authentication_service) on the homeserver then these delete devices endpoints always return a 404 even if the legacy auth API was used.

For the deactivate account endpoint it is implicit that it isn't supported when using the OAuth 2.0 API, but it doesn't say that it isn't available if you are using the Legacy auth API.

In summary:

|Client auth API|Spec says|Synapse+MAS implementation reality|
|-|-|-|
|[Legacy](https://spec.matrix.org/v1.15/client-server-api/#legacy-api)|It should work|Synapse returns 404 ❌|
|[OAuth 2.0](https://spec.matrix.org/v1.15/client-server-api/#oauth-20-api)|It is not available|Synapse returns 404 ✅|