Pair

App claims a pairing token OR short code → scoped, expiring Centrifugo sub-token.

Accepts EITHER the long QR token or the short human-typable code (task 929) in the same pairingToken field — matched case-insensitively with the hyphen/whitespace ignored. Single-use + bound: the claim is an atomic conditional update on the unused session, so a replay (or a race) cannot pair twice. Rejects unknown credentials, inactive sessions, and expired sessions. Brute-force protected: failed (unknown) attempts per client IP are rate-limited with a lockout, which is what makes the short code safe.