sync: overhaul sync system — device pairing, server_sequence, auto-sync, dashboards

BREAKING: replace legacy API keys with device tokens via pairing flow.
- Server: /api/client/pair, revoke, me endpoints; server_sequence + tombstones + idempotency
- Desktop client: PairDevice, GetMe, RevokeCurrent; auto-sync loop every 60s
- Config: device_token stored in separate file (0600), not config.yml
- Client DB: last_pull_seq migration for incremental pull
- Frontend (Svelte): settings modal with connect/disconnect/interval
- User dashboard (/dashboard): device list with status, revoke with password
- Admin dashboard (/admin/dashboard): devices table from /admin/api/devices
- CLI (cmd/verstak): updated for ServerSequence/GetState changes
- Fix: autoSyncLoop falls back to SQLite sync_state for server URL
- Fix: SyncSetInterval preserves server_url/device_id from SQLite

cmd/verstak/main.go

@@ -704,12 +704,12 @@ func runSyncPull(args []string) {
 	syncSvc := syncsvc.NewService(db, deviceID)
 	client := syncsvc.NewClient(cfg.Sync.ServerURL, cfg.Sync.APIKey, deviceID, abs)
 
-	_, _, lastRev, _, err := syncSvc.GetState()
+	_, _, lastSeq, _, err := syncSvc.GetState()
 	if err != nil {
-		lastRev = 0
+		lastSeq = 0
 	}
 
-	result, err := client.Pull(lastRev)
+	result, err := client.Pull(lastSeq)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Pull failed: %v\n", err)
 		os.Exit(1)
@@ -725,7 +725,7 @@ func runSyncPull(args []string) {
 		syncSvc.MarkApplied(opIDs)
 	}
 
-	fmt.Printf("Pulled %d ops (server rev: %d)\n", len(result.Ops), result.ServerRevision)
+	fmt.Printf("Pulled %d ops (server seq: %d)\n", len(result.Ops), result.ServerSequence)
 }
 
 func runSyncStatus(args []string) {