refactor(shared): strip cryptographic device provisioning (now telemetry-only)

devices rows no longer carry public_key for crypto purposes. The whole
per-device key API surface (provisionNewDevice, loadDevicePrivateKey,
saveDevicePrivateKey, forgetDevicePrivateKey, restoreDeviceFromServerRecord)
is removed; registerDevice now records {name, platform} only. SQL drops the
NOT NULL on devices.public_key so future telemetry rows can omit it.

Note: SQL not applied locally - push via pnpm prod:migrate when ready.

supabase/migrations/20260515000004_devices_public_key_optional.sql

@@ -0,0 +1,5 @@
+-- After the per-user encryption refactor, devices rows no longer carry
+-- cryptographic identity. Existing rows stay untouched; new telemetry rows
+-- can omit the column.
+
+alter table public.devices alter column public_key drop not null;