feat: add Phase 25.5a server-side device config API endpoints

- Add database migration (migrate_phase25_5a.sql):
  * Add owner_name, car_model, device_name, avatar_path columns to devices table
  * Add config_version and config_updated_at for cache invalidation

- Add server/modules/device_config.py:
  * get_device_config(device_id): retrieve config for Pi sync
  * update_device_config(device_id, data): update config with validation

- Add server API endpoints:
  * GET /api/device-config (authenticated with device_key, Pi fetches config)
  * POST /api/device-config (authenticated as user, admin updates config)

- Enhance server/modules/db.py:
  * Add get_device_by_id() function to retrieve all device config fields

Phase 25.5a enables server-side device identity management and connection-driven sync.
Pi will fetch from this endpoint when internet available, keeping config in sync.

Co-authored-by: Copilot <[email protected]>

server/modules/db.py

@@ -47,6 +47,28 @@ def get_device_by_name(name):
         return {"id": row[0], "name": row[1], "api_key_hash": row[2]}
 
 
+def get_device_by_id(device_id):
+    """Get device by ID, including config fields for Phase 25.5a."""
+    with get_cursor() as cur:
+        cur.execute(
+            "SELECT id, name, api_key_hash, owner_name, car_model, device_name, avatar_path, config_version FROM devices WHERE id = %s",
+            (device_id,),
+        )
+        row = cur.fetchone()
+        if row is None:
+            return None
+        return {
+            "id": row[0],
+            "name": row[1],
+            "api_key_hash": row[2],
+            "owner_name": row[3],
+            "car_model": row[4],
+            "device_name": row[5],
+            "avatar_path": row[6],
+            "config_version": row[7],
+        }
+
+
 def touch_device_last_seen(device_id):
     with get_cursor(commit=True) as cur:
         cur.execute(