Device API client: pair, device/me, events #3

HTTP client for the three device-facing routes in the backend's docs/wire-format.md:

• POST /api/v1/pair (no auth): {pairing_code, device_name, platform: "android"}, pairing code sent exactly as typed.
• GET /api/v1/device/me (Bearer): identity and server_time for the clock skew check. Startup only, never polled.
• POST /api/v1/events (Bearer): batches of up to 500 events / 512 KiB, positional per-event results.

Decisions:

• OkHttp + kotlinx.serialization.
• System CAs only, no user CAs, no pinning. The base URL must be https.
• Typed results: success, 401 (re-pair, no retry), 429 with Retry-After, other API errors by code, network failure.
• Request bodies contain only documented fields (the server rejects unknown fields), and optional label/domain are left out when absent.
• DeviceToken wrapper: toString() is always DeviceToken(***), and the plaintext is reachable only through an explicitly named method used for the Authorization header.
• Unit tests against MockWebServer. Test tokens are generated at runtime.

Out of scope: token persistence, sync scheduling, UI.