Add remote device disable with reason, and a public device status check

Device gains disabledReason (cleared automatically on re-enable). The
devices admin page prompts for a reason when disabling, and shows it
under the device's status once disabled.

New public GET /api/devices/:serial/status lets a field device check
whether it's disabled and why, before any user session exists —
unauthenticated by design, matching the existing serial-based trust
model used for devices/<serial>/log ingestion, and only ever reveals
a boolean plus a short reason string.

The devices/<serial>/log ingest path didn't check isActive at all
(the devices/<mqttUsername>/points path already did) — closed that
gap for both "log" and "status" message types so a disabled device's
data is rejected regardless of which path it arrives on.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/app.module.ts

@@ -12,6 +12,7 @@ import { IngestModule } from './ingest/ingest.module';
 import { RealtimeModule } from './realtime/realtime.module';
 import { ApiKeysModule } from './api-keys/api-keys.module';
 import { SimModule } from './sim/sim.module';
+import { DeviceStatusModule } from './device-status/device-status.module';
 
 @Module({
   imports: [
@@ -25,6 +26,7 @@ import { SimModule } from './sim/sim.module';
     RealtimeModule,
     ApiKeysModule,
     SimModule,
+    DeviceStatusModule,
   ],
   controllers: [AppController, StatusController],
   providers: [AppService],