Mint a pairing code

Creates a single-use code, claimable for five minutes, and the offer URL the dashboard renders as a QR code. The secret travels in the URL fragment so it never reaches a server log. Requires a signed-in session: a paired device may not mint another code, which is what stops a stolen phone from cloning itself. Requires the **viewer** role. An optional client UUID lets the caller check or cancel the exact code after a lost response. Reusing an existing UUID never reissues its secret.

curl -X POST "https://example.com/api/pair/codes" \  -H "Content-Type: application/json" \  -d '{}'

{  "id": "string",  "secret": "string",  "expiresAt": "2019-08-24T14:15:22Z",  "offerUrl": "string"}