Apply independent review findings and harden auth/CORS edges

[j0shcap]

Summary

Findings from a high-effort independent review of the last two PRs, all verified before fixing:

• Devices router split into public (register only) and protected (router-level auth) so future device routes are authenticated by default instead of opt-in
• Shared PROTECTED_ROUTES fixture replaces the route list duplicated across three test files; anon_client/client fixtures now share one builder in conftest
• Auth returns 401 instead of 500 if API_KEY disappears from the environment at request time
• CORS_ORIGINS="*" is rejected at startup — a wildcard with credentials would let any website make authenticated requests
• Startup warns when API_KEY is still the CHANGE_ME template placeholder
• Integration fixture: server output goes to a file instead of an undrained pipe (which would block the server once full), and the health poll sleeps unconditionally instead of busy-spinning on non-200s
• getenv idiom unified in main.py

Refuted by verification, no action: DB URL duplication, DELETE trailing-slash redirect, DB_ECHO fail-fast (designed contract), free-port TOCTOU (inherent to ephemeral ports, accepted).

Test plan

95 unit/API + 9 integration tests pass (three new hardening tests written red-first); coverage 99.6% against the 95% gate; ruff, format check, mypy, bandit clean.