Panels become devices: per-device documents in the flow repo, a Devices tab

- flow/devices.py: DeviceDef in FLOWS_DIR/_devices/<id>.json, committed under
  the flow store's write lock, 409 on a stale version; nonces in DEVICES_FILE
  outside git; in-memory presence announced as device_status
- api/routes/devices.py: CRUD, pairing with an optional {name, board,
  firmware}, a pending list adopted without a code from the LAN only, unpair;
  /panels/pair, /panels/pair/{code} and GET /panels/{id} kept as aliases,
  PUT /panels/ gone
- _device_may replaces _panel_may, JWT claims unchanged
- panels.json moves into devices once at startup, then .migrated
- MCP list_devices, get_device; search category device
- Devices tab (list, detail with presence, pairing, ordered dashboards,
  touch, I/O), PanelsDialog removed, serialised optimistic saves

docker/compose.yml

@@ -123,11 +123,13 @@ services:
       # credential and the key it pinned, so losing it on a rebuild would mean
       # enrolling again by hand. Absent until someone connects a portal.
       - CLOUD_CONFIG_FILE=/data/cloud.json
-      # Alert routing and the wall-panel pairings. Both are written at runtime,
+      # Alert routing and the device nonces. Both are written at runtime,
       # so off the volume they would land in the container's writable layer and
-      # be lost on the next rebuild — un-pairing every screen.
+      # be lost on the next rebuild — un-pairing every screen. PANELS_FILE is
+      # read once, by an instance from before devices, and renamed `.migrated`.
       - ALERTS_FILE=/data/alerts.json
       - PANELS_FILE=/data/panels.json
+      - DEVICES_FILE=/data/devices.json
       # The push keypair and the browsers subscribed to it. Off the volume, a
       # rebuild would silently stop every phone being notified: the key they
       # subscribed against would be gone.