OCMAP Pairing Auth

Implement the feature as a thin pairing-code layer on top of OpenClaw's existing signed device identity and trusted-device token flow. Do not invent a second long-lived auth system.

Workflow

1. Read references/protocol.md first.
2. If working on OpenClaw gateway or Control UI, read references/server-openclaw.md.
3. If working on OCMAP or another desktop client, read references/client-ocmap.md.
4. Keep server and client aligned on the exact request/response contract before wiring UI.

Required design