Make device bootstrap tokens single-use to prevent scope escalation

Editor assessment

This commit patches CVE-2026-32987. The header `fix(auth): make device bootstrap tokens single-use to prevent scope escalation` explains both mechanism and benefit, so the reader knows why reuse had to end; the auth scope and fix type are correct. The only content after the header is a well-formed `Refs: GHSA-63f5-hhc7-cx6p` footer, which is machine-readable and points at the advisory without pretending to be a closing keyword. There is no explanatory body, so the message does not describe how a bootstrap token could previously be replayed or which device states are now rejected. Clean style and a correct footer make it publishable, though it stops short of teaching the escalation path.