feat: instant companion pairing — device tokens, named QR, FIPS pair-info

- auth.createDeviceToken / listDeviceTokens / revokeDeviceToken RPCs; only
  SHA-256 hashes persist in data_dir/device-tokens.json
- auth.login accepts {token} (same rate limiter, skips TOTP like remember-me)
- pairing QR now carries name (server name, fallback "My Archipelago"),
  tok (instant login), and FIPS mesh params from new fips.pair-info RPC
  (npub, fips0 ULA, transport ports)
- companion onboarding drops the WireGuard install/tunnel screens — remote
  access moves to the FIPS mesh embedded in the companion app
- fix: fips daemon UDP bind now 2121, matching the published container port
  and fleet rosters (was upstream's 8668 — inbound UDP was dead on bridged
  installs, mesh silently rode TCP 8443)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/api/rpc/dispatcher.rs

@@ -26,6 +26,9 @@ impl RpcHandler {
             "auth.onboardingComplete" => self.handle_auth_onboarding_complete().await,
             "auth.isOnboardingComplete" => self.handle_auth_is_onboarding_complete().await,
             "auth.resetOnboarding" => self.handle_auth_reset_onboarding(params).await,
+            "auth.createDeviceToken" => self.handle_auth_create_device_token(params).await,
+            "auth.listDeviceTokens" => self.handle_auth_list_device_tokens().await,
+            "auth.revokeDeviceToken" => self.handle_auth_revoke_device_token(params).await,
 
             // Seed management (BIP-39 mnemonic)
             "seed.generate" => self.handle_seed_generate().await,
@@ -487,6 +490,7 @@ impl RpcHandler {
 
             // FIPS mesh transport
             "fips.status" => self.handle_fips_status().await,
+            "fips.pair-info" => self.handle_fips_pair_info().await,
             "fips.check-update" => self.handle_fips_check_update().await,
             "fips.apply-update" => self.handle_fips_apply_update().await,
             "fips.install" => self.handle_fips_install().await,