api: pair the mobile app with device tokens

MB1 (spec 13). Decision 0005: our own Android/iPhone app, Expo in the
mobile repo, user portal only, no push in v1.

- mobile_devices (migration 0013): one-time pairing codes from My settings
  (QR or server + code, 10 minutes), traded by the app for an spm_ device
  token that acts as its user and never as an admin
- POST /api/me/mobile-devices/pair (web session only), POST /api/mobile/pair,
  GET/DELETE /api/me/mobile-devices
- signing out everywhere (password change or reset, disabling) removes
  paired phones too
- My settings: Mobile app section with the QR code and paired phones
- mobile/ (its own repo) ignored here

docs/spec/07-provisioning.md

@@ -222,5 +222,5 @@ As built (M10-T3), `provisioning/linphone.ts`:
 
 Mobile limitation (state it plainly in the UI and admin guide): without push
 notifications, iOS and battery-optimized Android apps miss calls while in the
-background. A push gateway is a v2 item. For v1, recommend the desk phone + browser softphone,
+background. A push gateway is a v2 item (13 §6; our own app, 13, has the same limit in v1). For v1, recommend the desk phone + browser softphone,
 or call forwarding to a mobile number (CFNA) as the fallback.