Pair displays at the platform's own /display/setup, with or without modules

Displays are platform-owned, but a screen could only start pairing on a
module's display page: every pairing request named a module, so an
installation with no module that uses displays could not set one up.

- /display/setup is the platform's own display page, served whenever
  the deployment has device support, whatever is installed. It pairs a
  platform display with no module. Once paired, it opens the module it
  is set to show; with none set, it shows its name and waits, rechecking
  so it stays alive and notices revocation. "setup" is now a reserved
  module id.
- Migration core:0009_platform_display_pairing lets a pairing request
  name no module. It relaxes module_id and permission_id and adds a
  both-or-neither check. It is additive and destroys nothing.
- POST /api/v1/device-pairing/requests accepts {} for a platform
  display. Approval accepts an optional moduleId, so the administrator
  can choose an installed display module and the device gets that
  module's declared permission. A module display's own request can't be
  redirected.
- GET /api/v1/device-pairing/self lets a paired device describe itself:
  its name and the module displays it may show. It renews the device's
  cookie.
- GET /api/v1/devices/setup is replaced by
  GET /api/v1/devices/display-modules: the modules a display can be set
  to show.
- Settings -> Displays always offers the /display/setup address, Copy
  setup link and Add display. Add display has an optional "Show on this
  screen" choice, and each paired display says what it shows.
- /display/<module-id> is unchanged, so released Signage 0.1.5 works as
  before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

core/tests/account-store.integration.ts

@@ -177,6 +177,7 @@ async function applyCoreMigrations(url: string): Promise<void> {
       "core:0006_device_identity",
       "core:0007_verified_bootstrap_owners",
       "core:0008_user_preferences",
+      "core:0009_platform_display_pairing",
     ]);
     await applyModuleMigrations({ aggregate, database: createPostgresMigrationDatabase(url) });
   } finally {

core/tests/authorization-store.integration.ts

@@ -179,6 +179,7 @@ async function applyCoreMigrations(url: string): Promise<void> {
       "core:0006_device_identity",
       "core:0007_verified_bootstrap_owners",
       "core:0008_user_preferences",
+      "core:0009_platform_display_pairing",
     ]);
     await applyModuleMigrations({ aggregate, database: createPostgresMigrationDatabase(url) });
   } finally {

core/tests/dashboard-store.integration.ts

@@ -178,6 +178,7 @@ async function applyCoreMigrations(url: string): Promise<void> {
       "core:0006_device_identity",
       "core:0007_verified_bootstrap_owners",
       "core:0008_user_preferences",
+      "core:0009_platform_display_pairing",
     ]);
     await applyModuleMigrations({ aggregate, database: createPostgresMigrationDatabase(url) });
   } finally {

core/tests/device-pairing-schema.test.ts

@@ -0,0 +1,53 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { getTableConfig } from "drizzle-orm/pg-core";
+import { describe, expect, it } from "vitest";
+import { ekklesiaCoreDevicePairingRequest } from "../src/devices/index.js";
+
+/**
+ * A pairing request may name no module (ADR 0065): a screen on the platform's `/display/setup`
+ * pairs as a platform display, and a module is chosen for it, if at all, when it is approved.
+ */
+const migrationsDirectory = path.join(
+  path.dirname(path.dirname(fileURLToPath(import.meta.url))),
+  "drizzle",
+);
+
+describe("platform display pairing requests", () => {
+  it("lets a request name no module, but never a module without its permission", () => {
+    const config = getTableConfig(ekklesiaCoreDevicePairingRequest);
+    for (const name of ["module_id", "permission_id"]) {
+      expect(config.columns.find((column) => column.name === name)?.notNull, name).toBe(false);
+    }
+    expect(config.checks.map((check) => check.name)).toContain(
+      "ekklesia_core_device_pairing_module_check",
+    );
+  });
+
+  it("is migrated by relaxing two columns and adding the both-or-neither check, nothing else", async () => {
+    const sql = await readFile(
+      path.join(migrationsDirectory, "0009_platform_display_pairing.sql"),
+      "utf8",
+    );
+    const statements = sql
+      .split("--> statement-breakpoint")
+      .map((statement) => statement.trim())
+      .filter((statement) => statement.length > 0);
+    expect(statements).toEqual([
+      'ALTER TABLE "ekklesia_core_device_pairing_request" ALTER COLUMN "module_id" DROP NOT NULL;',
+      'ALTER TABLE "ekklesia_core_device_pairing_request" ALTER COLUMN "permission_id" DROP NOT NULL;',
+      'ALTER TABLE "ekklesia_core_device_pairing_request" ADD CONSTRAINT "ekklesia_core_device_pairing_module_check" CHECK (("ekklesia_core_device_pairing_request"."module_id" is null) = ("ekklesia_core_device_pairing_request"."permission_id" is null));',
+    ]);
+    // Existing requests, which all name a module, satisfy the new check unchanged.
+  });
+
+  it("is a migration that destroys nothing", async () => {
+    const metadata = JSON.parse(
+      await readFile(path.join(migrationsDirectory, "meta", "_ekklesia.json"), "utf8"),
+    ) as { entries: { tag: string; destructive: { mode: string } }[] };
+    expect(metadata.entries.find((entry) => entry.tag === "0009_platform_display_pairing")).toEqual(
+      { destructive: { mode: "none" }, tag: "0009_platform_display_pairing" },
+    );
+  });
+});

core/tests/module-configuration-store.integration.ts

@@ -180,6 +180,7 @@ async function applyCoreMigrations(url: string): Promise<void> {
       "core:0006_device_identity",
       "core:0007_verified_bootstrap_owners",
       "core:0008_user_preferences",
+      "core:0009_platform_display_pairing",
     ]);
     await applyModuleMigrations({ aggregate, database: createPostgresMigrationDatabase(url) });
   } finally {

core/tests/module-discovery.test.ts

@@ -9,6 +9,7 @@ import {
   isReservedModuleId,
   ModuleDiscoveryError,
   type ModuleDiscoveryIssueCode,
+  RESERVED_DISPLAY_HOST_NAMES,
   RESERVED_MODULE_IDS,
   RESERVED_SETTINGS_NAMES,
   RESERVED_TOP_LEVEL_NAMES,
@@ -301,9 +302,15 @@ describe("module discovery", () => {
       "displays",
       "general",
       "settings",
+      "setup",
       "system",
     ]);
-    for (const list of [RESERVED_MODULE_IDS, RESERVED_TOP_LEVEL_NAMES, RESERVED_SETTINGS_NAMES]) {
+    for (const list of [
+      RESERVED_MODULE_IDS,
+      RESERVED_TOP_LEVEL_NAMES,
+      RESERVED_SETTINGS_NAMES,
+      RESERVED_DISPLAY_HOST_NAMES,
+    ]) {
       expect(Object.isFrozen(list)).toBe(true);
     }
 

core/tests/module-lifecycle-store.integration.ts

@@ -183,6 +183,7 @@ async function applyCoreMigrations(url: string): Promise<void> {
       "core:0006_device_identity",
       "core:0007_verified_bootstrap_owners",
       "core:0008_user_preferences",
+      "core:0009_platform_display_pairing",
     ]);
     await applyModuleMigrations({ aggregate, database: createPostgresMigrationDatabase(url) });
   } finally {