Sync 2: device-token bearer auth + linked-devices UI (M8)

Native clients (Tauri/Android) authenticate sync with a long-lived device
bearer token, alongside the existing web session cookie.

Backend:
- security.py: generate_token() (secrets.token_urlsafe) + hash_token()
  (SHA-256 — device tokens are already high-entropy, so no slow KDF; keeps
  per-request bearer auth cheap). Only the hash is stored.
- device_tokens table (migration 0016): id, user_id, token_hash (unique),
  name, created_at, last_used_at.
- login_required now accepts `Authorization: Bearer <token>` OR the session
  cookie. Session path stays DB-free (fast); bearer path looks up the token
  hash, sets g.user_id, and stamps last_used_at.
- Endpoints: POST /api/auth/device-login (public; email+password → token,
  the native first-link flow), POST /api/auth/devices (session/bearer →
  token, web "link a device"), GET /api/auth/devices (list), DELETE
  /api/auth/devices/<id> (revoke). All owner-scoped; token shown once.

Frontend:
- Per-user (not admin) /account view "Linked devices": create a token
  (one-time reveal + copy), list devices (name, linked/last-synced), revoke
  with confirm. Top-bar device icon for all users; devices Pinia store.

Tests (DB-free): token hash determinism + uniqueness; device endpoints
auth-guard (401 without auth, before DB); device-login input validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/test_devices.py

@@ -0,0 +1,35 @@
+import pytest
+
+from thoughtsync.app import create_app
+
+
+@pytest.fixture
+def app():
+    return create_app()
+
+
+async def test_create_device_requires_auth(app):
+    # No session cookie and no bearer header → 401 before any DB access.
+    client = app.test_client()
+    resp = await client.post("/api/auth/devices", json={"name": "phone"})
+    assert resp.status_code == 401
+
+
+async def test_list_devices_requires_auth(app):
+    client = app.test_client()
+    resp = await client.get("/api/auth/devices")
+    assert resp.status_code == 401
+
+
+async def test_revoke_device_requires_auth(app):
+    client = app.test_client()
+    resp = await client.delete("/api/auth/devices/00000000-0000-0000-0000-000000000000")
+    assert resp.status_code == 401
+
+
+async def test_device_login_validates_input(app):
+    # Missing credentials → 400 BEFORE any DB access, so it's checkable in the
+    # DB-free unit lane (invalid-cred and success paths are operator-verified).
+    client = app.test_client()
+    resp = await client.post("/api/auth/device-login", json={})
+    assert resp.status_code == 400

tests/test_security.py

@@ -1,4 +1,4 @@
-from thoughtsync.security import hash_password, verify_password
+from thoughtsync.security import generate_token, hash_password, hash_token, verify_password
 
 
 def test_password_roundtrip():
@@ -7,6 +7,20 @@ def test_password_roundtrip():
     assert not verify_password("wrong password", h)
 
 
+def test_hash_token_deterministic():
+    t = generate_token()
+    # Lookup hash is deterministic (same token → same hash) and SHA-256 hex (64 chars).
+    assert hash_token(t) == hash_token(t)
+    assert len(hash_token(t)) == 64
+    # Different tokens hash differently.
+    assert hash_token(t) != hash_token(generate_token())
+
+
+def test_generate_token_unique():
+    assert generate_token() != generate_token()
+    assert len(generate_token()) >= 32
+
+
 def test_password_hash_is_salted():
     # Same input hashes differently each time (random salt).
     assert hash_password("same-input") != hash_password("same-input")