Sync 2: device-token bearer auth + linked-devices UI (M8)

Native clients (Tauri/Android) authenticate sync with a long-lived device
bearer token, alongside the existing web session cookie.

Backend:
- security.py: generate_token() (secrets.token_urlsafe) + hash_token()
  (SHA-256 — device tokens are already high-entropy, so no slow KDF; keeps
  per-request bearer auth cheap). Only the hash is stored.
- device_tokens table (migration 0016): id, user_id, token_hash (unique),
  name, created_at, last_used_at.
- login_required now accepts `Authorization: Bearer <token>` OR the session
  cookie. Session path stays DB-free (fast); bearer path looks up the token
  hash, sets g.user_id, and stamps last_used_at.
- Endpoints: POST /api/auth/device-login (public; email+password → token,
  the native first-link flow), POST /api/auth/devices (session/bearer →
  token, web "link a device"), GET /api/auth/devices (list), DELETE
  /api/auth/devices/<id> (revoke). All owner-scoped; token shown once.

Frontend:
- Per-user (not admin) /account view "Linked devices": create a token
  (one-time reveal + copy), list devices (name, linked/last-synced), revoke
  with confirm. Top-bar device icon for all users; devices Pinia store.

Tests (DB-free): token hash determinism + uniqueness; device endpoints
auth-guard (401 without auth, before DB); device-login input validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

frontend/src/stores/devices.ts

@@ -0,0 +1,40 @@
+import { defineStore } from "pinia";
+import { ref } from "vue";
+import { api } from "../api/client";
+
+// A linked native client (Tauri/Android) that holds a device bearer token.
+export interface Device {
+  id: string;
+  name: string;
+  created_at: string | null;
+  last_used_at: string | null;
+}
+
+export const useDevicesStore = defineStore("devices", () => {
+  const items = ref<Device[]>([]);
+  const loading = ref(false);
+
+  async function load(): Promise<void> {
+    loading.value = true;
+    try {
+      items.value = (await api.get<{ devices: Device[] }>("/api/auth/devices")).devices;
+    } finally {
+      loading.value = false;
+    }
+  }
+
+  // Issues a token for the current user; the plaintext token is returned ONCE
+  // (never retrievable again) for the caller to display + copy.
+  async function create(name: string): Promise<string> {
+    const res = await api.post<{ token: string; device: Device }>("/api/auth/devices", { name });
+    items.value.unshift(res.device);
+    return res.token;
+  }
+
+  async function revoke(id: string): Promise<void> {
+    await api.del(`/api/auth/devices/${id}`);
+    items.value = items.value.filter((d) => d.id !== id);
+  }
+
+  return { items, loading, load, create, revoke };
+});