Add remote device disable with reason, and a public device status check

Device gains disabledReason (cleared automatically on re-enable). The
devices admin page prompts for a reason when disabling, and shows it
under the device's status once disabled.

New public GET /api/devices/:serial/status lets a field device check
whether it's disabled and why, before any user session exists —
unauthenticated by design, matching the existing serial-based trust
model used for devices/<serial>/log ingestion, and only ever reveals
a boolean plus a short reason string.

The devices/<serial>/log ingest path didn't check isActive at all
(the devices/<mqttUsername>/points path already did) — closed that
gap for both "log" and "status" message types so a disabled device's
data is rejected regardless of which path it arrives on.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/devices/devices.service.ts

@@ -54,7 +54,16 @@ export class DevicesService {
 
   async update(orgId: string, deviceId: string, dto: UpdateDeviceDto) {
     await this.get(orgId, deviceId);
-    return this.prisma.device.update({ where: { id: deviceId }, data: dto });
+    const { disabledReason, ...rest } = dto;
+    return this.prisma.device.update({
+      where: { id: deviceId },
+      data: {
+        ...rest,
+        // A reason only makes sense while disabled; re-enabling always clears it.
+        ...(dto.isActive === true && { disabledReason: null }),
+        ...(dto.isActive === false && { disabledReason: disabledReason ?? null }),
+      },
+    });
   }
 
   async remove(orgId: string, deviceId: string) {