fix(private-link): speak /app/devices and migrate stored ingest_url master
The three production request paths now use the devices spelling: register (RegistrationCoordinator::repair), the finish_owner_start capability ingest path, and EVENT_PATH. Day-segment listing follows for free because list_day derives from the ingest path. REGISTER_PATH and INGEST_PATH sit alongside the existing EVENT_PATH const. load_observer rewrites a persisted ingest_url that is exactly /app/observer/ingest to /app/devices/ingest, returns the rewritten value, and writes it back best-effort through write_observer_durably. The rewrite sits after observer_is_valid, so invalid and malformed state stay read-only, and a failed write leaves the predecessor bytes intact without failing session start. No /app/observer alias, fallback, or re-register. protocol_version stays 2. Observer-role identifiers, headers, and the observer.json filename are unchanged. vendor/observer-client-contract/ is unchanged — its register response fixtures still carry the predecessor ingest_url, which is correct payload data.