feat: complete device onboarding and mobile binding workflows

internal/hardwareprovision/service.go

@@ -16,6 +16,7 @@ import (
 	"data-terminal-cloud/internal/audit"
 	"data-terminal-cloud/internal/deviceactivation"
 	"data-terminal-cloud/internal/deviceauth"
+	"data-terminal-cloud/internal/devicebinding"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -140,6 +141,9 @@ func (s *Service) Provision(ctx context.Context, identity deviceauth.Identity, r
 	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock(hashtextextended($1, 0))`, identity.ID); err != nil {
 		return ProvisionResponse{}, fmt.Errorf("lock hardware provider provisioning: %w", err)
 	}
+	if err := devicebinding.RequireLegacy(ctx, tx, identity.ID); err != nil {
+		return ProvisionResponse{}, err
+	}
 	activationState, err := s.prepareActivation(ctx, tx, identity, requestID)
 	if err != nil {
 		return ProvisionResponse{}, err