feat(loyalty): pair POS terminal devices with one-time setup QR

Adds the backend half of the Android tablet rollout. Merchants can
pair tablets to specific stores from /merchants/loyalty/devices (or
admins can pair on behalf from the merchant detail page). Each
pairing issues a long-lived JWT shown ONCE in the response with a
server-rendered QR PNG containing {api_url, store_code, auth_token} —
the tablet scans it on first boot and persists the three fields.

The store API (/api/v1/store/loyalty/*) now accepts these device JWTs
alongside user JWTs. Revoking a device row immediately rejects its
token (401 TERMINAL_DEVICE_REVOKED). Tokens expire after 1 year;
re-pair to renew.

- Migration loyalty_010 + TerminalDevice model
- create_device_token / verify_device_token JWT helpers
- 5 endpoints x 2 portals (merchant + admin on-behalf)
- Bearer-auth wiring in app/api/deps.py
- Pages, shared list partial with one-time pairing-QR modal,
  Alpine.js factories
- Locale strings (en authoritative; fr/de/lb seeded with EN copy
  for translation)
- 6 integration tests covering pair, list, revoke, idempotency,
  cross-merchant rejection, store-API auth via device JWT

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/routes/pages/admin.py

@@ -238,3 +238,28 @@ async def admin_loyalty_merchant_settings(
         "loyalty/admin/merchant-settings.html",
         get_admin_context(request, db, current_user, merchant_id=merchant_id),
     )
+
+
+@router.get(
+    "/merchants/{merchant_id}/devices",
+    response_class=HTMLResponse,
+    include_in_schema=False,
+)
+async def admin_loyalty_merchant_devices(
+    request: Request,
+    merchant_id: int = Path(..., description="Merchant ID"),
+    current_user: User = Depends(require_menu_access("loyalty-programs", FrontendType.ADMIN)),
+    db: Session = Depends(get_db),
+):
+    """List + pair POS terminal devices on behalf of a merchant."""
+    merchant_name = _get_merchant_name(db, merchant_id)
+    return templates.TemplateResponse(
+        "loyalty/admin/merchant-devices.html",
+        get_admin_context(
+            request,
+            db,
+            current_user,
+            merchant_id=merchant_id,
+            merchant_name=merchant_name,
+        ),
+    )

app/modules/loyalty/routes/pages/merchant.py

@@ -279,3 +279,28 @@ async def merchant_loyalty_settings(
         "loyalty/merchant/settings.html",
         context,
     )
+
+
+# ============================================================================
+# TERMINAL DEVICES (POS tablet pairing)
+# ============================================================================
+
+
+@router.get("/devices", response_class=HTMLResponse, include_in_schema=False)
+async def merchant_loyalty_devices(
+    request: Request,
+    current_user: UserContext = Depends(get_current_merchant_from_cookie_or_header),
+    merchant: Merchant = Depends(get_merchant_for_current_user_page),
+    db: Session = Depends(get_db),
+):
+    """List + pair POS terminal devices for the merchant."""
+    context = _get_merchant_context(
+        request,
+        db,
+        current_user,
+        merchant_id=merchant.id,
+    )
+    return templates.TemplateResponse(
+        "loyalty/merchant/devices.html",
+        context,
+    )