Restart safety: transient credential checks are 1013/503, not a refusal

- A device credential that cannot be checked now (device store not running,
  nonces unreadable) raises DeviceUnavailable: 503 over HTTP, and the
  /flows/ws handshake and the tunnel stream accept and close with 1013.
  1008 (a 403 before accepting) stays for a revoked or invalid one
- Device files are written through a temporary file, so a read mid-save no
  longer looks like a deleted device
- The first report turns Touch friendly on only for a device paired since
  pairings are noted (DeviceState.paired_at), so devices paired before keep
  the switch they were given
- NodeDef reads `device`/`device_policy` from older clients as the worker
  label, for a release
- Tests: transient vs revoked socket, the touch default, the old worker keys,
  and a restart with a device node and a node_health rule sending no push

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138N7k5PT4dcR1iEqXaaQ9k

docs/interface/dashboards.md

@@ -565,7 +565,8 @@ sends only while somebody wants it.
 The device's page shows the report under **Capabilities**, with each port's
 binding or **Use in flow** for it. A reported screen becomes a canvas preset in
 the dashboard settings, named after the device, and the first report of a
-touch screen turns **Touch friendly** on.
+touch screen turns **Touch friendly** on. A device paired before this version
+keeps the switch as it was set.
 
 ### Before device nodes