caller-requested scope set remains authoritative; cached scopes are only

reused when the client is reusing the stored per-device token.

- Device tokens can be rotated/revoked via `device.token.rotate` and

`device.token.revoke` (requires `operator.pairing` scope).

`device.token.revoke` (requires `operator.pairing` scope). Rotating or

revoking a node or other non-operator role also requires `operator.admin`.

- `device.token.rotate` returns rotation metadata. It echoes the replacement

bearer token only for same-device calls that are already authenticated with

that device token, so token-only clients can persist their replacement before

recorded in that device's pairing entry; token mutation cannot expand or

target a device role that pairing approval never granted.

- For paired-device token sessions, device management is self-scoped unless the

caller also has `operator.admin`: non-admin callers can remove/revoke/rotate

only their **own** device entry.

caller also has `operator.admin`: non-admin callers can manage only the

operator token for their **own** device entry. Node and other non-operator

token management is admin-only, even for the caller's own device.

- `device.token.rotate` and `device.token.revoke` also check the target operator

token scope set against the caller's current session scopes. Non-admin callers

cannot rotate or revoke a broader operator token than they already hold.