Server 2.1.0: pair cars by QR code instead of typing the token

Modelled on the OAuth device authorization grant (RFC 8628) and on
only when APPROVAL_PASSWORD is set (at least 12 characters):

- POST /v1/pair/start opens a request for an installation and returns
  a short user code and the /pair URL for the car's QR code;
  POST /v1/pair/poll returns pending, the car's own token (once),
  denied or expired. Requests live 10 minutes, in memory.
- GET/POST /pair is a script-free approval page for the phone
  (strict CSP, no framing). Five wrong passwords lock approvals for a
  minute.
- Each car gets its own 43-character token; only its SHA-256 is stored
  (measurement "device"), and the device is persisted before the car
  can collect the token. Tokens are loaded at startup, so a restart
  keeps paired cars working; the server refuses to start if they cannot
  be loaded.
- GET /v1/devices and POST /v1/devices/{id}/revoke, authenticated with
  the approval password, list and revoke cars.
- The shared INGEST_TOKEN keeps working.

31 tests (race detector clean), govulncheck clean. Tested end to end
against InfluxDB 2.7.12: pairing, wrong password, single collection,
persistence across restarts, revocation (also across a restart), and
that InfluxDB holds only the hash.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/store.go

@@ -17,6 +17,8 @@ type Store interface {
 	WriteConsumptionChunk(ctx context.Context, chunk ConsumptionChunk) error
 	WriteChargingSession(ctx context.Context, session ChargingSession) error
 	ReadConsumptionChunks(ctx context.Context, installationID string) ([]ConsumptionChunk, error)
+	SaveDevice(ctx context.Context, d Device) error
+	LoadDevices(ctx context.Context) ([]Device, error)
 }
 
 // InfluxStore keeps everything in one InfluxDB 2 bucket; every point carries an
@@ -26,6 +28,7 @@ type Store interface {
 //	consumption_chunk  time = recordedAt   tags: date     km, kwh, hours, socDrop, sohPercent
 //	charging_session   time = startedAt    tags: sessionId summary fields
 //	charging_curve     time = point time   tags: sessionId powerKw, socPercent
+//	device             time = createdAt    tags: deviceId  tokenHash, installationId, revoked
 //
 // Idempotency comes from InfluxDB itself: a point with the same measurement, tags and
 // timestamp replaces the earlier one. The car re-sends a cached chunk with its original
@@ -160,3 +163,38 @@ func floatValue(v any) float64 {
 	f, _ := v.(float64)
 	return f
 }
+
+// SaveDevice writes a paired car. Re-saving it (a revocation) overwrites the same point,
+// because measurement, tag and timestamp stay the same.
+func (s *InfluxStore) SaveDevice(ctx context.Context, d Device) error {
+	return s.write.WritePoint(ctx, influxdb2.NewPoint("device",
+		map[string]string{"deviceId": d.ID},
+		map[string]any{"tokenHash": d.TokenHash, "installationId": d.InstallationID, "revoked": d.Revoked},
+		d.CreatedAt))
+}
+
+func (s *InfluxStore) LoadDevices(ctx context.Context) ([]Device, error) {
+	query := fmt.Sprintf(`from(bucket: %s)
+  |> range(start: 0)
+  |> filter(fn: (r) => r._measurement == "device")
+  |> pivot(rowKey: ["_time"], columnKey: ["_field"], valueColumn: "_value")`, fluxString(s.bucket))
+	result, err := s.query.Query(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	defer result.Close()
+	var devices []Device
+	for result.Next() {
+		r := result.Record()
+		id, _ := r.ValueByKey("deviceId").(string)
+		hash, _ := r.ValueByKey("tokenHash").(string)
+		installation, _ := r.ValueByKey("installationId").(string)
+		revoked, _ := r.ValueByKey("revoked").(bool)
+		if id == "" || hash == "" {
+			continue
+		}
+		devices = append(devices, Device{ID: id, InstallationID: installation, TokenHash: hash,
+			CreatedAt: r.Time(), Revoked: revoked})
+	}
+	return devices, result.Err()
+}