feat(sync): approve new devices without recovery keys

[ComputelessComputer]

Summary

• add an expiring service-role enrollment mailbox with atomic five-device replacement
• expose authenticated enrollment APIs and regenerate the typed client
• automatically register, approve, import, and resume sync while keeping recovery-key entry as a fallback
• add device-management UX, translations, and backend/desktop regression coverage

Test plan

• supabase test db
• cargo check --workspace --all-targets
• cargo test --workspace
• cargo clippy --workspace --all-targets --locked -- -D warnings
• pnpm -r typecheck
• pnpm -F desktop test
• pnpm exec oxlint --quiet --format=github apps/desktop/src/
• pnpm -F desktop i18n:check

---

Note

High Risk
Changes the encrypted sync onboarding and credential path (E2EE enrollment, device limits, Pro gating) and adds security-sensitive API surface; regressions could block sync or mishandle keys.

Overview
Adds device-to-device E2EE enrollment so a new desktop can join encrypted cloud sync after approval from an existing device, with recovery-key setup kept only for the first device or as a fallback.

The API gains /sync/devices (list/remove) and /sync/e2ee/device-enrollments (register, seal, consume) plus OpenAPI types for pending/sealed enrollment packages. The desktop sync-devices client drives Sync settings (approve, remove, replace at the 5-device cap) and cloudsync now registers the local device, polls while approval_pending, imports a sealed package, then continues credential exchange—handling 409 (no existing key yet), 403 device limit, and updated limit toasts/copy.

Copy and translations shift onboarding from “paste recovery key on every device” to approve from another signed-in device, with “Use recovery key instead” where needed.

^{Reviewed by Cursor Bugbot for commit 246773a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for anarlog ready!

Name	Link
🔨 Latest commit	3a60611
🔍 Latest deploy log	https://app.netlify.com/projects/anarlog/deploys/6a866ccd2a01940008b488bb
😎 Deploy Preview	https://deploy-preview-6942--anarlog.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for anarlog canceled.

Name	Link
🔨 Latest commit	246773a
🔍 Latest deploy log	https://app.netlify.com/projects/anarlog/deploys/6a866f99f9903700082cc8ae

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3a60611. Configure here.}