Add community node socket: devices, tickets, consent gate, kill switch

Phase 3 of plan.md. Device registration with one-time secrets, scoped single-use
socket tickets, the lock-owner WS /nodes/ws with handshake and heartbeat eviction,
a single batch ConsentGate, and NodesService which disconnects nodes within one tick
when consent, device or the nodes_enabled kill switch changes. A reconcile of 2000
sessions measured about 110 ms after replacing per-session queries with batches.
Devii may withdraw but never grant bandwidth_sharing.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/api/nodes/conftest.py

@@ -0,0 +1,50 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+
+import pytest
+from fastapi.testclient import TestClient
+
+from devplacepy.database import get_setting, get_table, set_consent, set_setting
+from devplacepy.database.nodes import save_node_settings
+from devplacepy.main import app
+from devplacepy.services.manager import service_manager
+from devplacepy.utils import register_account
+
+_counter = [0]
+
+
+def unique(prefix: str) -> str:
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def make_member(*, consent=True, enabled=True, age_band="adult", role="Member") -> dict:
+    name = unique("nodemb")
+    uid, _, _ = register_account(
+        name, f"{name}@t.dev", "secret123", age_band=age_band, accepted_terms=True
+    )
+    if role != "Member":
+        get_table("users").update({"uid": uid, "role": role}, ["uid"])
+    if consent:
+        set_consent("user", uid, "bandwidth_sharing", True)
+    if enabled:
+        save_node_settings(uid, {"enabled": True})
+    row = get_table("users").find_one(uid=uid)
+    return {"uid": uid, "username": name, "headers": {"X-API-KEY": row["api_key"]}}
+
+
+@pytest.fixture(scope="module")
+def client():
+    previous = get_setting("nodes_enabled", "0")
+    set_setting("nodes_enabled", "1")
+    with TestClient(app) as test_client:
+        service_manager.set_lock_owner(True)
+        yield test_client
+        service_manager.set_lock_owner(False)
+    set_setting("nodes_enabled", previous)
+
+
+@pytest.fixture
+def member(client):
+    return make_member()