security: random per-device API token + one-shot pairing window (CRIT auth-bypass fix)

The bearer token was sha256(serial)[:32] and the serial is served unauthenticated, so anyone reaching :5000 could compute it and take the device over. Now: token is a random secrets.token_urlsafe(32) at /data/adacam/api_token (never derived from serial); /pair only returns it during a one-shot pairing window (/data/adacam/pairing_open, opened by adacam-pair or install.sh, closes after one pair); require_auth uses hmac.compare_digest. NEEDS ON-DEVICE PAIRING TEST before merge to main — see SECURITY-PAIRING.md.

install.sh

@@ -13,6 +13,9 @@ mkdir -p "$INSTALL_DIR" "$DATA_DIR"
 # Copy files
 cp -r adacam_api main.py requirements.txt "$INSTALL_DIR/"
 
+# Install the pairing helper (opens a one-shot /pair window — see SECURITY-PAIRING.md)
+install -m 0755 bin/adacam-pair /usr/local/bin/adacam-pair
+
 # Install Python dependencies
 pip3 install --no-cache-dir -r "$INSTALL_DIR/requirements.txt"
 
@@ -27,6 +30,15 @@ if [ ! -f "$DATA_DIR/config.json" ]; then
     echo "[*] Config will be generated on first API start"
 fi
 
+# Open a one-shot pairing window on a FRESH provision so the first app pair works
+# out of the box (it closes after one successful pair). On an existing install
+# (token already issued) we leave the window closed — re-pair with `adacam-pair`.
+if [ ! -f "$DATA_DIR/api_token" ]; then
+    : > "$DATA_DIR/pairing_open"
+    chmod 600 "$DATA_DIR/pairing_open" 2>/dev/null || true
+    echo "[*] Pairing window opened for first pair (run 'adacam-pair' to reopen later)"
+fi
+
 echo "[*] Starting adacam-api..."
 systemctl restart adacam-api
 systemctl status adacam-api --no-pager || true