feat: complete device onboarding and mobile binding workflows

internal/httpapi/ops_device_handlers.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"data-terminal-cloud/internal/concurrency"
+	"data-terminal-cloud/internal/devicebinding"
 	"data-terminal-cloud/internal/identity"
 	"data-terminal-cloud/internal/opsdevice"
 )
@@ -268,6 +269,8 @@ func opsDevicePrincipal(w http.ResponseWriter, r *http.Request) (principal ident
 
 func writeOpsDeviceError(w http.ResponseWriter, r *http.Request, err error) {
 	switch {
+	case errors.Is(err, devicebinding.ErrConfirmationRequired):
+		WriteError(w, r, http.StatusConflict, "DEVICE_CONFIRMATION_REQUIRED", "该设备使用生产凭据和按键确认流程，请使用首次接入管理入口")
 	case errors.Is(err, opsdevice.ErrInvalid):
 		writeValidation(w, r, "设备管理参数不正确", FieldError{Field: "device", Message: "设备字段或家庭/长者归属不正确"})
 	case errors.Is(err, opsdevice.ErrAccessDenied):