Add community node socket: devices, tickets, consent gate, kill switch

Phase 3 of plan.md. Device registration with one-time secrets, scoped single-use
socket tickets, the lock-owner WS /nodes/ws with handshake and heartbeat eviction,
a single batch ConsentGate, and NodesService which disconnects nodes within one tick
when consent, device or the nodes_enabled kill switch changes. A reconcile of 2000
sessions measured about 110 ms after replacing per-session queries with batches.
Devii may withdraw but never grant bandwidth_sharing.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/api/profile/consent.py

@@ -208,3 +208,39 @@ def test_the_mature_preference_round_trips(app_server):
     )
     refresh_snapshot()
     assert get_table("users").find_one(uid=user["uid"])["mature_opt_in"] in (0, False)
+
+
+def test_an_agent_cannot_grant_a_member_only_consent_but_can_withdraw_it(app_server):
+    session, name, user = _member()
+    agent = {**JSON, "X-Devii-Agent": "1"}
+    url = f"{BASE_URL}/profile/{name}/consent"
+    refused = session.post(
+        url, data={"kind": "bandwidth_sharing", "granted": "1"}, headers=agent
+    )
+    assert refused.status_code == 403
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "bandwidth_sharing") is False
+
+    own = session.post(
+        url, data={"kind": "bandwidth_sharing", "granted": "1"}, headers=JSON
+    )
+    assert own.status_code == 200
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "bandwidth_sharing") is True
+
+    withdrawn = session.post(
+        url, data={"kind": "bandwidth_sharing", "granted": "0"}, headers=agent
+    )
+    assert withdrawn.status_code == 200
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "bandwidth_sharing") is False
+
+
+def test_an_agent_can_still_grant_an_ordinary_consent(app_server):
+    session, name, user = _member()
+    response = session.post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "1"},
+        headers={**JSON, "X-Devii-Agent": "1"},
+    )
+    assert response.status_code == 200