feat: complete device onboarding and mobile binding workflows

internal/saas/device_binding_service.go

@@ -10,6 +10,7 @@ import (
 	"data-terminal-cloud/internal/audit"
 	"data-terminal-cloud/internal/database"
 	"data-terminal-cloud/internal/deviceactivation"
+	"data-terminal-cloud/internal/devicebinding"
 	"data-terminal-cloud/internal/identity"
 
 	"github.com/jackc/pgx/v5"
@@ -72,6 +73,11 @@ func (s *Service) ChangeDeviceBinding(ctx context.Context, principal identity.Pr
 			return err
 		}
 		var bindingID string
+		if input.Action == DeviceBindingActionTransfer {
+			if err = devicebinding.RequireLegacy(ctx, tx, access.deviceID); err != nil {
+				return err
+			}
+		}
 		if err := tx.QueryRow(ctx, `SELECT public_id::text FROM device_binding WHERE device_id=$1::uuid AND tenant_id=$2::uuid AND unbound_at IS NULL FOR UPDATE`, access.deviceID, access.tenantID).Scan(&bindingID); errors.Is(err, pgx.ErrNoRows) {
 			return ErrDeviceBindingStale
 		} else if err != nil {