feat(loyalty): pair POS terminal devices with one-time setup QR

Adds the backend half of the Android tablet rollout. Merchants can
pair tablets to specific stores from /merchants/loyalty/devices (or
admins can pair on behalf from the merchant detail page). Each
pairing issues a long-lived JWT shown ONCE in the response with a
server-rendered QR PNG containing {api_url, store_code, auth_token} —
the tablet scans it on first boot and persists the three fields.

The store API (/api/v1/store/loyalty/*) now accepts these device JWTs
alongside user JWTs. Revoking a device row immediately rejects its
token (401 TERMINAL_DEVICE_REVOKED). Tokens expire after 1 year;
re-pair to renew.

- Migration loyalty_010 + TerminalDevice model
- create_device_token / verify_device_token JWT helpers
- 5 endpoints x 2 portals (merchant + admin on-behalf)
- Bearer-auth wiring in app/api/deps.py
- Pages, shared list partial with one-time pairing-QR modal,
  Alpine.js factories
- Locale strings (en authoritative; fr/de/lb seeded with EN copy
  for translation)
- 6 integration tests covering pair, list, revoke, idempotency,
  cross-merchant rejection, store-API auth via device JWT

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/static/admin/js/loyalty-merchant-devices.js

@@ -0,0 +1,23 @@
+// app/modules/loyalty/static/admin/js/loyalty-merchant-devices.js
+const adminMerchantDevicesLog = window.LogConfig.loggers.adminMerchantDevices || window.LogConfig.createLogger('adminMerchantDevices');
+
+function adminMerchantDevices() {
+    const merchantId = document.body.dataset.merchantId
+        || (window.location.pathname.match(/\/merchants\/(\d+)/) || [])[1];
+    if (!merchantId) {
+        adminMerchantDevicesLog.error('Could not determine merchant_id from URL');
+    }
+    return loyaltyDevicesList({
+        apiPrefix: '/admin/loyalty/merchants/' + merchantId,
+        // Admin reuses the merchant locations endpoint for the store dropdown.
+        locationsApiPrefix: '/admin/loyalty/merchants/' + merchantId,
+        showStoreFilter: true,
+        showCrud: true,
+        currentPage: 'admin-merchant-devices',
+    });
+}
+
+if (!window.LogConfig.loggers.adminMerchantDevices) {
+    window.LogConfig.loggers.adminMerchantDevices = window.LogConfig.createLogger('adminMerchantDevices');
+}
+adminMerchantDevicesLog.info('Admin merchant devices module loaded');