feat: instant companion pairing — device tokens, named QR, FIPS pair-info

- auth.createDeviceToken / listDeviceTokens / revokeDeviceToken RPCs; only
  SHA-256 hashes persist in data_dir/device-tokens.json
- auth.login accepts {token} (same rate limiter, skips TOTP like remember-me)
- pairing QR now carries name (server name, fallback "My Archipelago"),
  tok (instant login), and FIPS mesh params from new fips.pair-info RPC
  (npub, fips0 ULA, transport ports)
- companion onboarding drops the WireGuard install/tunnel screens — remote
  access moves to the FIPS mesh embedded in the companion app
- fix: fips daemon UDP bind now 2121, matching the published container port
  and fleet rosters (was upstream's 8668 — inbound UDP was dead on bridged
  installs, mesh silently rode TCP 8443)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/fips/mod.rs

@@ -119,6 +119,15 @@ pub const UPSTREAM_REPO: &str = "jmcorgan/fips";
 /// Default UDP port the daemon listens on.
 pub const DEFAULT_UDP_PORT: u16 = 8668;
 
+/// UDP port archipelago actually publishes/binds for the daemon. The
+/// container publishes `2121:2121/udp` (see `package/config.rs`) and every
+/// peer roster in the fleet dials `<host>:2121`, but the rendered daemon
+/// config used to bind upstream's 8668 — leaving inbound UDP dead on
+/// bridged-network installs and everything silently riding TCP 8443. The
+/// bind now uses this port so the published mapping, the fleet rosters,
+/// and the pairing QR all agree.
+pub const PUBLISHED_UDP_PORT: u16 = 2121;
+
 /// Default TCP port the daemon listens on. Used as a fallback when a
 /// peer can't be reached over UDP — common on networks that block UDP
 /// (corporate/guest wifi) and the path the public fips.v0l.io anchor