Device security and robustness (openpanel C0): check code, pnc, lenient report

- POST /devices/pair answers a 2-character `check`, listed by /devices/pending
  and shown beside each waiting entry; five codes a minute per address, and at
  50 waiting the oldest gives way instead of a 429
- portal-minted device tokens are asked for with the device's nonce (`pnc`) and
  held against it, so unpair and delete revoke them; one without `pnc` stands
  only while the nonce is 0
- a device credential acts as the device (`device_principal`), not as the
  approving superuser, so deleting that account unpairs nothing
- the report is validated port by port: unknown enum values read as `unknown`,
  unreadable ports and sections are left out and logged, `config` may name an
  entry of `config_schemas`; 422 only for no schema 1 or no object
- devices.json is parsed once per change (cached by stat), delete drops the
  report and keeps the nonce, a busy recheck runs in the background
- scope and io only from enabled flows (start/stop tells the devices), a port
  bound twice gives one io row
- the Devices tab's saves cancel and hold back device refetches until settled

frontend/src/routes/panel.index.tsx

@@ -170,6 +170,21 @@ function PairPanel() {
           ) : null}
         </div>
 
+        {/* Through the portal only the code pairs, so there is no list to
+            pick this screen from. */}
+        {started?.check && !isPortal() ? (
+          <p className="text-sm text-muted-foreground">
+            Picked from the waiting list instead? Its check is{" "}
+            <span
+              className="font-mono font-medium text-foreground"
+              data-testid="pairing-check"
+            >
+              {started.check}
+            </span>
+            .
+          </p>
+        ) : null}
+
         <p className="text-sm text-muted-foreground">
           The code lasts ten minutes; this screen replaces it when it runs out.
         </p>