fix: reuse upload credentials for device config sync

- load server sync creds from db/upload_creds.env like uploads do
- fall back from YARIS_DEVICE_KEY to existing YARIS_API_KEY
- document shared credential flow for server-synced identity
- add test coverage for sync credential fallback

Co-authored-by: Copilot <[email protected]>

PLAN.md

@@ -1504,7 +1504,8 @@ phase roadmap.
   - Fetches config from `/api/device-config` endpoint (device_key auth)
   - Detects changes via config_version
   - Stores synced config in SQLite
-  - Environment vars: `YARIS_SERVER_URL`, `YARIS_DEVICE_KEY`
+  - Reuses the existing upload credentials from `db/upload_creds.env`
+    (`YARIS_SERVER_URL` + `YARIS_API_KEY`; `YARIS_DEVICE_KEY` also accepted as an override)
   - Ready for hot-reload on config change (future: signal handler)
   
 - **Pi startup** (`app.py`):
@@ -1525,7 +1526,7 @@ phase roadmap.
 #### Testing
 - Server endpoints accessible via `/api/device-config`
 - Pi thread starts on boot (check logs for connectivity attempts)
-- Sync disabled if `YARIS_SERVER_URL` or `YARIS_DEVICE_KEY` not set
+- Sync disabled if `YARIS_SERVER_URL` or an API key (`YARIS_API_KEY` / `YARIS_DEVICE_KEY`) is not set
 - **2026-08-10 access verification**: SSH access confirmed to Pi at `[email protected]`
   (new WiFi card/subnet) and to unraid via `ssh unraid` (`[email protected]`).
   Follow-up deployment succeeded the same day: Pi fast-forwarded from `d7b9bb6` to `cd004fb`,