feat(loyalty): pair POS terminal devices with one-time setup QR

Adds the backend half of the Android tablet rollout. Merchants can
pair tablets to specific stores from /merchants/loyalty/devices (or
admins can pair on behalf from the merchant detail page). Each
pairing issues a long-lived JWT shown ONCE in the response with a
server-rendered QR PNG containing {api_url, store_code, auth_token} —
the tablet scans it on first boot and persists the three fields.

The store API (/api/v1/store/loyalty/*) now accepts these device JWTs
alongside user JWTs. Revoking a device row immediately rejects its
token (401 TERMINAL_DEVICE_REVOKED). Tokens expire after 1 year;
re-pair to renew.

- Migration loyalty_010 + TerminalDevice model
- create_device_token / verify_device_token JWT helpers
- 5 endpoints x 2 portals (merchant + admin on-behalf)
- Bearer-auth wiring in app/api/deps.py
- Pages, shared list partial with one-time pairing-QR modal,
  Alpine.js factories
- Locale strings (en authoritative; fr/de/lb seeded with EN copy
  for translation)
- 6 integration tests covering pair, list, revoke, idempotency,
  cross-merchant rejection, store-API auth via device JWT

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/exceptions.py

@@ -331,6 +331,42 @@ class OrderReferenceRequiredException(LoyaltyException):
         )
 
 
+# =============================================================================
+# Terminal Device Exceptions
+# =============================================================================
+
+
+class TerminalDeviceNotFoundException(ResourceNotFoundException):
+    """Raised when a terminal device is not found."""
+
+    def __init__(self, identifier: str):
+        super().__init__("TerminalDevice", identifier)
+
+
+class TerminalDeviceRevokedException(LoyaltyException):
+    """Raised when a request presents a revoked terminal device token."""
+
+    def __init__(self, device_id: int):
+        super().__init__(
+            message="Terminal device has been revoked",
+            error_code="TERMINAL_DEVICE_REVOKED",
+            details={"device_id": device_id},
+        )
+        self.status_code = 401
+
+
+class TerminalDeviceExpiredException(LoyaltyException):
+    """Raised when a request presents an expired terminal device token."""
+
+    def __init__(self, device_id: int):
+        super().__init__(
+            message="Terminal device token has expired — re-pair the tablet",
+            error_code="TERMINAL_DEVICE_EXPIRED",
+            details={"device_id": device_id},
+        )
+        self.status_code = 401
+
+
 # =============================================================================
 # Validation Exceptions
 # =============================================================================
@@ -385,6 +421,10 @@ __all__ = [
     "CustomerIdentifierRequiredException",
     # Order
     "OrderReferenceRequiredException",
+    # Terminal Device
+    "TerminalDeviceNotFoundException",
+    "TerminalDeviceRevokedException",
+    "TerminalDeviceExpiredException",
     # Validation
     "LoyaltyValidationException",
 ]