feat: complete device onboarding and mobile binding workflows

test/fixtures/local_seed.sql

@@ -143,6 +143,12 @@ VALUES (
 ON CONFLICT (device_id) DO UPDATE SET desired_config = EXCLUDED.desired_config,
     capabilities = EXCLUDED.capabilities, updated_at = now();
 
+-- This unbound terminal predates lifecycle migration 50. Seeding happens after
+-- migrations, so establish its actual lifecycle explicitly for repeatable tests.
+UPDATE device SET activation_state='CLAIMABLE'
+WHERE id='10000000-0000-0000-0000-000000000502'::uuid
+ AND enrollment_mode='legacy' AND NOT EXISTS(SELECT 1 FROM device_binding WHERE device_id=device.id AND unbound_at IS NULL);
+
 INSERT INTO device_claim (
     id, public_id, tenant_id, device_id, token_digest, expires_at
 )

test/fixtures/onboarding-devreq1.json

@@ -0,0 +1,13 @@
+{
+  "KeyHex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+  "Method": "POST",
+  "Path": "/api/v1/device/poll",
+  "DeviceID": "KP01-AABBCCDDEEFF",
+  "KeyVersion": 1,
+  "Timestamp": 1789099200000,
+  "Nonce": "AAECAwQFBgcICQoLDA0ODw",
+  "RequestID": "10000000-0000-4000-8000-000000000001",
+  "Body": "{\"setup_id\":\"10000000-0000-4000-8000-000000000002\",\"boot_id\":\"10000000-0000-4000-8000-000000000003\",\"known_revision\":0}",
+  "Signature": "7cdca29d6df37a10b7f609bd730ba315f3fa54b190438b0ac123423c2e462eef",
+  "Canonical": "DEVREQ1\nPOST\n/api/v1/device/poll\nKP01-AABBCCDDEEFF\n1\n1789099200000\nAAECAwQFBgcICQoLDA0ODw\n10000000-0000-4000-8000-000000000001\n6141fad648c181b517993384c594611014001a9f9d6a12e55ee9070e958ed2af"
+}