api: pair the mobile app with device tokens

MB1 (spec 13). Decision 0005: our own Android/iPhone app, Expo in the
mobile repo, user portal only, no push in v1.

- mobile_devices (migration 0013): one-time pairing codes from My settings
  (QR or server + code, 10 minutes), traded by the app for an spm_ device
  token that acts as its user and never as an admin
- POST /api/me/mobile-devices/pair (web session only), POST /api/mobile/pair,
  GET/DELETE /api/me/mobile-devices
- signing out everywhere (password change or reset, disabling) removes
  paired phones too
- My settings: Mobile app section with the QR code and paired phones
- mobile/ (its own repo) ignored here

docs/spec/00-overview.md

@@ -27,7 +27,7 @@ Target user: one small business or home lab, 1–100 extensions, one server.
 Do NOT build these in v1. Do not leave half-built hooks for them either.
 
 - Multi-tenancy (several companies on one install)
-- Native mobile apps (we document open source SIP apps instead, see `07-provisioning.md`)
+- ~~Native mobile apps~~: reversed 2026-10-26, our own app is `13-mobile.md` (decision 0005)
 - Video calls, screen sharing, team chat
 - Fax
 - CRM integrations (the REST API + webhooks are the integration point)