feat(backend): GET /devices — list the caller's own devices

[Olorunfemi20]

closes #156

Summary

Adds a GET /devices endpoint that returns the authenticated user's registered devices, backed by the user_devices table. The list includes revoked devices (for device history) and flags the device bound to the caller's session.

Changes

• New devicesRouter (src/routes/devices.ts) exposing GET /devices, mounted at /devices in app.ts and guarded by requireAuth.
• Response: [{ id, deviceId, deviceName, platform, lastSeenAt, createdAt, revokedAt, current }].
  • Scoped to the authenticated user (WHERE user_id = <caller>).
  • Active devices first (revoked_at IS NULL), then most recently registered; revoked devices are included with revokedAt set.
  • current is true for the device whose deviceId matches the caller's JWT.
  • Only public fields are selected; identity key, registration id, and user id never reach the response.
• Extended JwtPayload with an optional deviceId so the session can be associated with a registered device. The field is optional and backward compatible with existing tokens; when absent, every device is reported as current: false.
• Added src/__tests__/devices.test.ts covering auth, user scoping, active-first ordering with revoked devices, current flagging (with and without a deviceId claim), response shape, and the database-failure path.

Acceptance criteria

• Only the caller's devices are returned.
• Revoked devices are included and sorted active-first.
• current correctly flags the requesting device.

Notes

This builds on the user_devices schema (#153). Population of deviceId in issued tokens belongs to the device registration/login flow and is intentionally out of scope here; the endpoint degrades gracefully until then.

[drips-wave]

@Olorunfemi20 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits