feat: persist runtime device authentication

[rogerchappel]

Summary

• connect the Gateway pool to the encrypted per-runtime device credential store
• persist newly issued or rotated device tokens before marking a connection ready
• restore approved scopes only for the matching stable device identity
• clear rejected device tokens while retaining the shared recovery credential
• opportunistically encrypt legacy plaintext device private keys
• stop authentication failures from being repeated across fallback URLs

Why

The protocol client can now perform the official device-token lifecycle, but it needs durable per-runtime storage to survive process restarts and shared-token drift.

Stack

Depends on #706, which depends on #705. Onboarding capture follows in the next stacked PR.

Verification

• pnpm test -- src/lib/gateway-chat-pool.test.ts src/lib/gateway-client-auth-lifecycle.test.ts src/lib/runtime-device-auth.test.ts
• pnpm exec tsc --noEmit --pretty false --incremental false
• pnpm exec eslint src/lib/gateway-chat-pool.ts src/lib/gateway-chat-pool.test.ts
• pre-push pnpm typecheck
• pre-push pnpm build
• git diff --check