feat: complete device onboarding and mobile binding workflows

internal/saas/device_claim.go

@@ -11,6 +11,7 @@ import (
 	"data-terminal-cloud/internal/audit"
 	"data-terminal-cloud/internal/database"
 	"data-terminal-cloud/internal/deviceactivation"
+	"data-terminal-cloud/internal/devicebinding"
 	"data-terminal-cloud/internal/identity"
 
 	"github.com/jackc/pgx/v5"
@@ -57,6 +58,9 @@ func (s *Service) ClaimDevice(ctx context.Context, principal identity.Principal,
 		} else if err != nil {
 			return fmt.Errorf("resolve device claim: %w", err)
 		}
+		if err = devicebinding.RequireLegacy(ctx, tx, deviceID); err != nil {
+			return err
+		}
 		if revokedAt != nil || !expiresAt.After(time.Now()) {
 			return ErrDeviceClaimInvalid
 		}
@@ -70,7 +74,10 @@ func (s *Service) ClaimDevice(ctx context.Context, principal identity.Principal,
 				JOIN device d ON d.id=b.device_id AND d.tenant_id=b.tenant_id
 				JOIN household h ON h.id=b.household_id AND h.tenant_id=b.tenant_id
 				JOIN subject_profile sp ON sp.id=b.subject_id AND sp.tenant_id=b.tenant_id
-				WHERE b.id=$1::uuid`, *usedBindingID).Scan(&result.BindingID, &result.DeviceID, &result.HouseholdID, &result.SubjectID, &result.BoundAt); err != nil {
+					WHERE b.id=$1::uuid AND b.unbound_at IS NULL AND b.generation=d.binding_generation`, *usedBindingID).Scan(&result.BindingID, &result.DeviceID, &result.HouseholdID, &result.SubjectID, &result.BoundAt); err != nil {
+				if errors.Is(err, pgx.ErrNoRows) {
+					return ErrDeviceClaimUsed
+				}
 				return fmt.Errorf("read used device claim binding: %w", err)
 			}
 			if result.HouseholdID != householdPublicID || result.SubjectID != subjectPublicID {