Add remote device disable with reason, and a public device status check

Device gains disabledReason (cleared automatically on re-enable). The
devices admin page prompts for a reason when disabling, and shows it
under the device's status once disabled.

New public GET /api/devices/:serial/status lets a field device check
whether it's disabled and why, before any user session exists —
unauthenticated by design, matching the existing serial-based trust
model used for devices/<serial>/log ingestion, and only ever reveals
a boolean plus a short reason string.

The devices/<serial>/log ingest path didn't check isActive at all
(the devices/<mqttUsername>/points path already did) — closed that
gap for both "log" and "status" message types so a disabled device's
data is rejected regardless of which path it arrives on.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/device-status/device-status.controller.ts

@@ -0,0 +1,16 @@
+import { Controller, Get, Param } from '@nestjs/common';
+import { DeviceStatusService } from './device-status.service';
+
+// Public and unauthenticated by design: a field device checks in by serial
+// number alone (the same trust model already used for devices/<serial>/log
+// MQTT ingestion) before any human has logged it into an org. The response
+// only ever reveals a boolean + a short admin-written reason string.
+@Controller('devices')
+export class DeviceStatusController {
+  constructor(private readonly deviceStatusService: DeviceStatusService) {}
+
+  @Get(':serial/status')
+  getStatus(@Param('serial') serial: string) {
+    return this.deviceStatusService.getStatus(serial);
+  }
+}