fix: authenticate device config sync like upload client

- send X-Device-Name and X-Api-Key to /api/device-config
- require YARIS_DEVICE_NAME alongside shared upload creds
- fix server create_device output to match actual Pi env names
- document shared upload/config sync credential requirements

Co-authored-by: Copilot <[email protected]>

PLAN.md

@@ -1505,7 +1505,8 @@ phase roadmap.
   - Detects changes via config_version
   - Stores synced config in SQLite
   - Reuses the existing upload credentials from `db/upload_creds.env`
-    (`YARIS_SERVER_URL` + `YARIS_API_KEY`; `YARIS_DEVICE_KEY` also accepted as an override)
+    (`YARIS_SERVER_URL` + `YARIS_DEVICE_NAME` + `YARIS_API_KEY`;
+    `YARIS_DEVICE_KEY` also accepted as an override for the key)
   - Ready for hot-reload on config change (future: signal handler)
   
 - **Pi startup** (`app.py`):
@@ -1526,7 +1527,8 @@ phase roadmap.
 #### Testing
 - Server endpoints accessible via `/api/device-config`
 - Pi thread starts on boot (check logs for connectivity attempts)
-- Sync disabled if `YARIS_SERVER_URL` or an API key (`YARIS_API_KEY` / `YARIS_DEVICE_KEY`) is not set
+- Sync disabled if `YARIS_SERVER_URL`, `YARIS_DEVICE_NAME`, or an API key
+  (`YARIS_API_KEY` / `YARIS_DEVICE_KEY`) is not set
 - **2026-08-10 access verification**: SSH access confirmed to Pi at `[email protected]`
   (new WiFi card/subnet) and to unraid via `ssh unraid` (`[email protected]`).
   Follow-up deployment succeeded the same day: Pi fast-forwarded from `d7b9bb6` to `cd004fb`,