sync: overhaul sync system — device pairing, server_sequence, auto-sync, dashboards

BREAKING: replace legacy API keys with device tokens via pairing flow.
- Server: /api/client/pair, revoke, me endpoints; server_sequence + tombstones + idempotency
- Desktop client: PairDevice, GetMe, RevokeCurrent; auto-sync loop every 60s
- Config: device_token stored in separate file (0600), not config.yml
- Client DB: last_pull_seq migration for incremental pull
- Frontend (Svelte): settings modal with connect/disconnect/interval
- User dashboard (/dashboard): device list with status, revoke with password
- Admin dashboard (/admin/dashboard): devices table from /admin/api/devices
- CLI (cmd/verstak): updated for ServerSequence/GetState changes
- Fix: autoSyncLoop falls back to SQLite sync_state for server URL
- Fix: SyncSetInterval preserves server_url/device_id from SQLite

internal/core/config/config.go

@@ -10,29 +10,29 @@ import (
 
 // Config lives at .verstak/config.yml inside the vault.
 type Config struct {
-	Engine      EngineConfig `yaml:"engine"`
-	Sync        SyncConfig   `yaml:"sync"`
-	Browser     BrowserConfig `yaml:"browser"`
+	Engine  EngineConfig  `yaml:"engine"`
+	Sync    SyncConfig    `yaml:"sync"`
+	Browser BrowserConfig `yaml:"browser"`
 }
 
 type EngineConfig struct {
-	Version     int    `yaml:"version"`
-	VaultID     string `yaml:"vault_id"`
-	CreatedAt   string `yaml:"created_at"`
-	VaultRoot   string `yaml:"vault_root"`
+	Version   int    `yaml:"version"`
+	VaultID   string `yaml:"vault_id"`
+	CreatedAt string `yaml:"created_at"`
+	VaultRoot string `yaml:"vault_root"`
 }
 
 type SyncConfig struct {
-	ServerURL   string `yaml:"server_url"`
-	APIKey      string `yaml:"api_key"`
-	DeviceID    string `yaml:"device_id"`
-	AutoSync    bool   `yaml:"auto_sync"`
-	SyncInterval int   `yaml:"sync_interval"`
+	ServerURL    string `yaml:"server_url"`
+	APIKey       string `yaml:"api_key"`
+	DeviceID     string `yaml:"device_id"`
+	AutoSync     bool   `yaml:"auto_sync"`
+	SyncInterval int    `yaml:"sync_interval"`
 }
 
 type BrowserConfig struct {
-	Enabled     bool   `yaml:"enabled"`
-	LocalPort   int    `yaml:"local_port"`
+	Enabled   bool `yaml:"enabled"`
+	LocalPort int  `yaml:"local_port"`
 }
 
 // Load reads .verstak/config.yml from the vault root.
@@ -67,3 +67,41 @@ func Save(vaultRoot string, cfg *Config) error {
 func MetaDir(vaultRoot string) string {
 	return filepath.Join(vaultRoot, ".verstak")
 }
+
+// DeviceTokenPath returns the path to the device_token file.
+func DeviceTokenPath(vaultRoot string) string {
+	return filepath.Join(vaultRoot, ".verstak", "device_token.json")
+}
+
+// SaveDeviceToken writes the device token to a separate file with 0600 perms.
+func SaveDeviceToken(vaultRoot, token string) error {
+	path := DeviceTokenPath(vaultRoot)
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o750); err != nil {
+		return err
+	}
+	data := fmt.Sprintf(`{"device_token":%q}`, token)
+	return os.WriteFile(path, []byte(data), 0o600)
+}
+
+// LoadDeviceToken reads the device token from the separate file.
+func LoadDeviceToken(vaultRoot string) string {
+	path := DeviceTokenPath(vaultRoot)
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	var v struct {
+		DeviceToken string `yaml:"device_token"`
+	}
+	if err := yaml.Unmarshal(data, &v); err != nil {
+		return ""
+	}
+	return v.DeviceToken
+}
+
+// RemoveDeviceToken deletes the device token file.
+func RemoveDeviceToken(vaultRoot string) error {
+	path := DeviceTokenPath(vaultRoot)
+	return os.Remove(path)
+}