Server 2.1.0: pair cars by QR code instead of typing the token

Modelled on the OAuth device authorization grant (RFC 8628) and on
only when APPROVAL_PASSWORD is set (at least 12 characters):

- POST /v1/pair/start opens a request for an installation and returns
  a short user code and the /pair URL for the car's QR code;
  POST /v1/pair/poll returns pending, the car's own token (once),
  denied or expired. Requests live 10 minutes, in memory.
- GET/POST /pair is a script-free approval page for the phone
  (strict CSP, no framing). Five wrong passwords lock approvals for a
  minute.
- Each car gets its own 43-character token; only its SHA-256 is stored
  (measurement "device"), and the device is persisted before the car
  can collect the token. Tokens are loaded at startup, so a restart
  keeps paired cars working; the server refuses to start if they cannot
  be loaded.
- GET /v1/devices and POST /v1/devices/{id}/revoke, authenticated with
  the approval password, list and revoke cars.
- The shared INGEST_TOKEN keeps working.

31 tests (race detector clean), govulncheck clean. Tested end to end
against InfluxDB 2.7.12: pairing, wrong password, single collection,
persistence across restarts, revocation (also across a restart), and
that InfluxDB holds only the hash.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/api_test.go

@@ -16,6 +16,7 @@ type fakeStore struct {
 	telemetry []TelemetrySample
 	chunks    []ConsumptionChunk
 	sessions  []ChargingSession
+	devices   []Device
 	fail      error
 }
 
@@ -46,17 +47,37 @@ func (f *fakeStore) WriteChargingSession(_ context.Context, s ChargingSession) e
 	return f.fail
 }
 
+func (f *fakeStore) SaveDevice(_ context.Context, d Device) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.fail != nil {
+		return f.fail
+	}
+	f.devices = append(f.devices, d)
+	return nil
+}
+
+func (f *fakeStore) LoadDevices(context.Context) ([]Device, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.devices, f.fail
+}
+
 func (f *fakeStore) ReadConsumptionChunks(context.Context, string) ([]ConsumptionChunk, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	return f.chunks, f.fail
 }
 
-const testToken = "ingest-test-token-0123456789abcdef"
+const (
+	testToken            = "ingest-test-token-0123456789abcdef"
+	testApprovalPassword = "approval-password-123"
+)
 
 func newTestAPI() (*API, *fakeStore) {
 	store := &fakeStore{}
-	return &API{Store: store, IngestToken: testToken, Forwarder: &Forwarder{}}, store
+	return &API{Store: store, IngestToken: testToken, Forwarder: &Forwarder{},
+		Pairing: NewPairing(testApprovalPassword, nil), PublicURL: "https://car.example.com"}, store
 }
 
 func do(t *testing.T, h http.Handler, method, path, token, body string) *httptest.ResponseRecorder {