Server 2.1.0: pair cars by QR code instead of typing the token

Modelled on the OAuth device authorization grant (RFC 8628) and on
only when APPROVAL_PASSWORD is set (at least 12 characters):

- POST /v1/pair/start opens a request for an installation and returns
  a short user code and the /pair URL for the car's QR code;
  POST /v1/pair/poll returns pending, the car's own token (once),
  denied or expired. Requests live 10 minutes, in memory.
- GET/POST /pair is a script-free approval page for the phone
  (strict CSP, no framing). Five wrong passwords lock approvals for a
  minute.
- Each car gets its own 43-character token; only its SHA-256 is stored
  (measurement "device"), and the device is persisted before the car
  can collect the token. Tokens are loaded at startup, so a restart
  keeps paired cars working; the server refuses to start if they cannot
  be loaded.
- GET /v1/devices and POST /v1/devices/{id}/revoke, authenticated with
  the approval password, list and revoke cars.
- The shared INGEST_TOKEN keeps working.

31 tests (race detector clean), govulncheck clean. Tested end to end
against InfluxDB 2.7.12: pairing, wrong password, single collection,
persistence across restarts, revocation (also across a restart), and
that InfluxDB holds only the hash.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/api.go

@@ -17,10 +17,17 @@ import (
 //	PUT  /v1/charging-sessions/{sessionId}       one finished DC charging session
 //	GET  /v1/consumption/history/{installationId} the car reads its own totals back
 //	GET  /v1/health                              unauthenticated liveness probe
+//
+// A car authenticates with the shared INGEST_TOKEN or with its own token from pairing
+// (pairing_http.go).
 type API struct {
 	Store       Store
 	IngestToken string
 	Forwarder   *Forwarder
+	Pairing     *Pairing
+	// PublicURL is the server's address as a phone reaches it, for the pairing QR code;
+	// derived from the request when empty.
+	PublicURL string
 }
 
 const maxBodyBytes = 512 * 1024
@@ -34,18 +41,24 @@ func (a *API) Routes() http.Handler {
 	mux.HandleFunc("PUT /v1/consumption/daily", a.ingest(a.consumption))
 	mux.HandleFunc("PUT /v1/charging-sessions/{sessionId}", a.ingest(a.chargingSession))
 	mux.HandleFunc("GET /v1/consumption/history/{installationId}", a.ingest(a.history))
+	a.pairingRoutes(mux)
 	return mux
 }
 
-// hasIngestToken compares in constant time. main refuses to start with a token under 24
-// characters, so an empty or short configured token can never match here.
+// hasIngestToken accepts the shared token (compared in constant time; main refuses to start
+// with one under 24 characters, so an empty or short one never matches) or a paired car's
+// own, unrevoked token.
 func (a *API) hasIngestToken(r *http.Request) bool {
 	header := r.Header.Get("Authorization")
 	supplied, ok := strings.CutPrefix(header, "Bearer ")
-	if !ok || len(a.IngestToken) < minIngestTokenLength {
+	if !ok || supplied == "" {
 		return false
 	}
-	return subtle.ConstantTimeCompare([]byte(supplied), []byte(a.IngestToken)) == 1
+	if len(a.IngestToken) >= minIngestTokenLength &&
+		subtle.ConstantTimeCompare([]byte(supplied), []byte(a.IngestToken)) == 1 {
+		return true
+	}
+	return a.Pairing.Authorized(supplied)
 }
 
 type handler func(w http.ResponseWriter, r *http.Request, body []byte) error