feat(companion): night-test polish sweep — 0.5.9

Everything from tonight's remote field testing:

- Back-to-dashboard fixed: JS bridges on the retained WebView delegated
  through live-composition callbacks (stale closures made apps refuse to
  launch after remote ⇄ dashboard), and reattach forces a layout pass
  (top/bottom UI was wrong until a tap).
- F*CK IPs MESH branded loader: full-screen on relaunch (startup race)
  and during the first connect after scanning a node QR.
- Party 'Share this app' is now a QR of the public vps2 download link
  (scan with any camera → install over any internet); direct APK
  file-share kept as a secondary action.
- Mesh party pairing is MUTUAL: scanner announces itself to the scanned
  phone's Flare /hello — both sides get the peer, a chat entry and a
  '👋 joined the party' message; scanner auto-opens the chat.
- Party scanner asks for CAMERA permission (fresh installs/reinstalls
  landed on a black preview).
- Node: device tokens mint unique companion-<id> names — pairing a
  second phone no longer revokes the first phone's login (the source of
  'reconnecting a lot' and the second phone's failure).

Served APK: 0.5.9 (vc29).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/api/rpc/auth.rs

@@ -106,7 +106,7 @@ impl RpcHandler {
         &self,
         params: Option<serde_json::Value>,
     ) -> Result<serde_json::Value> {
-        let name = params
+        let mut name = params
             .as_ref()
             .and_then(|p| p.get("name"))
             .and_then(|v| v.as_str())
@@ -116,6 +116,14 @@ impl RpcHandler {
         if name.is_empty() || name.len() > 64 {
             return Err(anyhow::anyhow!("Device name must be 1-64 characters"));
         }
+        // The default name was a single shared slot: every pairing popup
+        // replaced the previous phone's token, silently logging out the
+        // first phone the moment a second one paired. Default-named mints
+        // get a unique suffix so each device keeps its own credential;
+        // explicitly named devices keep replace-in-place semantics.
+        if name == "companion" {
+            name = format!("companion-{}", hex::encode(rand::random::<[u8; 2]>()));
+        }
         let token = crate::device_tokens::create(&self.config.data_dir, &name).await?;
         Ok(serde_json::json!({ "name": name, "token": token }))
     }