api: pair the mobile app with device tokens

MB1 (spec 13). Decision 0005: our own Android/iPhone app, Expo in the
mobile repo, user portal only, no push in v1.

- mobile_devices (migration 0013): one-time pairing codes from My settings
  (QR or server + code, 10 minutes), traded by the app for an spm_ device
  token that acts as its user and never as an admin
- POST /api/me/mobile-devices/pair (web session only), POST /api/mobile/pair,
  GET/DELETE /api/me/mobile-devices
- signing out everywhere (password change or reset, disabling) removes
  paired phones too
- My settings: Mobile app section with the QR code and paired phones
- mobile/ (its own repo) ignored here

docs/spec/04-backend-api.md

@@ -58,6 +58,10 @@ Bearer requests don't need `X-Requested-With` (no cookie is used, and a cross-si
 Authorization). A token can't list, make or revoke tokens (403): a leaked one can't make itself a
 spare. `lastUsedAt` is written on every request. Settings → API tokens.
 
+### 2.3a Mobile device tokens
+`Authorization: Bearer spm_<40 base62>`, made by pairing a phone and acting as its user, never as
+an admin (`requireAdmin` refuses them). See `13-mobile.md` §2 and §4.
+
 ### 2.4 Guards
 Fastify `preHandler` hooks in `auth/guards.ts`:
 - `requireAuth`: sets `req.user`.