Add remote device disable with reason, and a public device status check

Device gains disabledReason (cleared automatically on re-enable). The
devices admin page prompts for a reason when disabling, and shows it
under the device's status once disabled.

New public GET /api/devices/:serial/status lets a field device check
whether it's disabled and why, before any user session exists —
unauthenticated by design, matching the existing serial-based trust
model used for devices/<serial>/log ingestion, and only ever reveals
a boolean plus a short reason string.

The devices/<serial>/log ingest path didn't check isActive at all
(the devices/<mqttUsername>/points path already did) — closed that
gap for both "log" and "status" message types so a disabled device's
data is rejected regardless of which path it arrives on.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/prisma/schema.prisma

@@ -138,6 +138,9 @@ model Device {
   serialNumber String?   @unique
   mqttUsername String?   @unique
   isActive     Boolean   @default(true)
+  // Set (and cleared on re-enable) via the devices admin page; a device
+  // fetches this via GET /api/devices/:serial/status to show on its own screen.
+  disabledReason String?
   lastSeenAt   DateTime? @db.Timestamptz(6)
   createdAt    DateTime  @default(now()) @db.Timestamptz(6)
   updatedAt    DateTime  @updatedAt @db.Timestamptz(6)