Two-way pairing: codes can now originate on the device and be claimed from the web, in addition to the existing web→device direction. This closes the loop for OTA-flashed devices that land without baked creds — they can self-recover identity without going through flash-mac. - native link.mjs: with no arg, POSTs device-pair {action:"create"}, shows the returned code prominently with "on prompt.ac type: link XYZ", then polls device-pair?code=XYZ until claimed (~10 min server TTL). With an arg, behaves as before (consumer mode for web-generated codes). - web link.mjs: `link CODE` skips the create step and goes straight to the auth-bound claim, completing the device-initiated handshake. New green "claimed — device is linking…" confirmation state. - os.mjs: hasCreds() reads /mnt/config.json on boot; when handle/token are missing (typical after OTA flashed the public initramfs over the creds-baked one), enters a "link-prompt" state. y → jump to link (device-initiated flow); n → fall through to normal version-check.