Pair displays at the platform's own /display/setup, with or without modules

Displays are platform-owned, but a screen could only start pairing on a
module's display page: every pairing request named a module, so an
installation with no module that uses displays could not set one up.

- /display/setup is the platform's own display page, served whenever
  the deployment has device support, whatever is installed. It pairs a
  platform display with no module. Once paired, it opens the module it
  is set to show; with none set, it shows its name and waits, rechecking
  so it stays alive and notices revocation. "setup" is now a reserved
  module id.
- Migration core:0009_platform_display_pairing lets a pairing request
  name no module. It relaxes module_id and permission_id and adds a
  both-or-neither check. It is additive and destroys nothing.
- POST /api/v1/device-pairing/requests accepts {} for a platform
  display. Approval accepts an optional moduleId, so the administrator
  can choose an installed display module and the device gets that
  module's declared permission. A module display's own request can't be
  redirected.
- GET /api/v1/device-pairing/self lets a paired device describe itself:
  its name and the module displays it may show. It renews the device's
  cookie.
- GET /api/v1/devices/setup is replaced by
  GET /api/v1/devices/display-modules: the modules a display can be set
  to show.
- Settings -> Displays always offers the /display/setup address, Copy
  setup link and Add display. Add display has an optional "Show on this
  screen" choice, and each paired display says what it shows.
- /display/<module-id> is unchanged, so released Signage 0.1.5 works as
  before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/development/testing.md

@@ -488,11 +488,27 @@ The second review's corrections
 ([ADR 0065](../architecture/decisions/0065-display-setup-phone-forms-and-drawer-scroll-lock.md)) are
 proven here:
 
-- `apps/api/tests/device-pairing.integration.ts` covers `GET /api/v1/devices/setup`. It names each
-  display page, is `no-store`, and refuses an unpaired or paired screen.
-- `surfaces/shell/tests/displays-settings.test.tsx` covers the setup steps on the API origin: Copy
-  link with and without a clipboard, several modules, none installed, a failed read, and a refused
-  non-root-relative page.
+- `apps/api/tests/device-pairing.integration.ts`, on real PostgreSQL:
+  - with **zero** modules installed, a screen at `/display/setup` pairs as a platform display with
+    no permission;
+  - the display can describe itself, an administrator cannot impersonate it, and revocation works;
+  - an administrator can choose the module a platform display shows at approval;
+  - a module display's own request cannot be redirected, and unknown keys and modules are refused.
+- `apps/api/tests/module-display-routes.test.ts` serves `/display/setup` and the display host with
+  zero display modules, and only with device support.
+- `core/tests/device-pairing-schema.test.ts` pins migration `0009` to its three additive statements.
+- `surfaces/shell/tests/display-setup-app.test.tsx` covers the setup page:
+  - it pairs with no module and waits, named;
+  - it opens the module it is set to show;
+  - it opens a module as soon as one is set;
+  - it returns to a code when revoked;
+  - it never pairs on a server failure.
+- `surfaces/shell/tests/displays-settings.test.tsx` covers:
+  - the platform setup address, and **Copy setup link**;
+  - **Add display** with zero display modules;
+  - the **Show on this screen** choice;
+  - a module display's request showing its fixed module;
+  - pairing still working when the module list cannot be read.
 - `surfaces/shell/tests/scroll-lock.test.ts` covers:
   - the root locked and its previous styles restored;
   - drags outside the drawer cancelled, and drags inside it allowed except past its ends;
@@ -503,7 +519,11 @@ proven here:
 - `surfaces/shell/tests/viewport.test.ts` keeps zoom available on both shell pages.
 - `packages/ui/tests/tokens.test.ts` holds text controls at 16px or more on phones and touch screens.
 - `packages/ui/tests/interaction.test.tsx` checks that the focus trap returns focus without scrolling.
-- The deploy smoke checks, in real Chromium:
+- The deploy smoke checks:
+  - `/display/setup` and a module-less pairing request through the proxy, in both topologies, so in
+    the same-origin run with no module at all;
+  - in real Chromium, a screen in its own browser context at `/display/setup` showing a code, being
+    added through Settings, and then opening its chosen module, or waiting, named;
   - the setup steps on the API origin;
   - the page locked behind the open drawer and released after;
   - the pairing field at 16px or more on a phone.