Device security and robustness (openpanel C0): check code, pnc, lenient report

- POST /devices/pair answers a 2-character `check`, listed by /devices/pending
  and shown beside each waiting entry; five codes a minute per address, and at
  50 waiting the oldest gives way instead of a 429
- portal-minted device tokens are asked for with the device's nonce (`pnc`) and
  held against it, so unpair and delete revoke them; one without `pnc` stands
  only while the nonce is 0
- a device credential acts as the device (`device_principal`), not as the
  approving superuser, so deleting that account unpairs nothing
- the report is validated port by port: unknown enum values read as `unknown`,
  unreadable ports and sections are left out and logged, `config` may name an
  entry of `config_schemas`; 422 only for no schema 1 or no object
- devices.json is parsed once per change (cached by stat), delete drops the
  report and keeps the nonce, a busy recheck runs in the background
- scope and io only from enabled flows (start/stop tells the devices), a port
  bound twice gives one io row
- the Devices tab's saves cancel and hold back device refetches until settled

frontend/src/components/Flow/useFlowSocket.ts

@@ -4,7 +4,7 @@ import { useEffect } from "react"
 
 import { ApiError, FlowsService, OpenAPI } from "@/client"
 import { dashboardKeys } from "@/components/Dashboard/queries"
-import { deviceKeys } from "@/components/Devices/queries"
+import { deviceKeys, refetchDevices } from "@/components/Devices/queries"
 import { healthKeys } from "@/components/Health/queries"
 import { runKeys } from "@/components/Runs/queries"
 import { connectionStore } from "@/lib/connectionStore"
@@ -418,16 +418,16 @@ function open(url: string) {
         // `exact` matters — the list key is a prefix of every detail key,
         // including the draft an editor may have open.
         client?.invalidateQueries({ queryKey: dashboardKeys.all, exact: true })
-        client?.invalidateQueries({
-          queryKey: message.dashboard
-            ? dashboardKeys.detail(message.dashboard)
-            : deviceKeys.all,
-        })
+        if (message.dashboard)
+          client?.invalidateQueries({
+            queryKey: dashboardKeys.detail(message.dashboard),
+          })
+        else if (client) refetchDevices(client, false)
         break
       case "device_status":
         // A device's socket opened or closed: the Devices tab reads presence
         // off the list.
-        client?.invalidateQueries({ queryKey: deviceKeys.all, exact: true })
+        if (client) refetchDevices(client)
         break
       case "run_started":
       case "run_finished":