Device security and robustness (openpanel C0): check code, pnc, lenient report

- POST /devices/pair answers a 2-character `check`, listed by /devices/pending
  and shown beside each waiting entry; five codes a minute per address, and at
  50 waiting the oldest gives way instead of a 429
- portal-minted device tokens are asked for with the device's nonce (`pnc`) and
  held against it, so unpair and delete revoke them; one without `pnc` stands
  only while the nonce is 0
- a device credential acts as the device (`device_principal`), not as the
  approving superuser, so deleting that account unpairs nothing
- the report is validated port by port: unknown enum values read as `unknown`,
  unreadable ports and sections are left out and logged, `config` may name an
  entry of `config_schemas`; 422 only for no schema 1 or no object
- devices.json is parsed once per change (cached by stat), delete drops the
  report and keeps the nonce, a busy recheck runs in the background
- scope and io only from enabled flows (start/stop tells the devices), a port
  bound twice gives one io row
- the Devices tab's saves cancel and hold back device refetches until settled

backend/tests/utils/portal.py

@@ -31,6 +31,7 @@ def portal_token(
     audience: str = INSTANCE_ID,
     issuer: str = ISSUER,
     scope: str = "proxy",
+    **claims: Any,
 ) -> str:
     now = datetime.now(UTC)
     pem = key.private_bytes(
@@ -46,6 +47,7 @@ def portal_token(
             "iat": now,
             "exp": now + timedelta(hours=1),
             "scope": scope,
+            **claims,
         },
         pem,
         algorithm="RS256",