feat: fail-closed mobile pairing cancellation and terminal lifecycle

[CompleteDotTech]

Summary

Makes pairing cancellation a first-class, fail-closed state transition (OpenCoven#814). Today, declining the confirmation prompt or abandoning coven mobile pair leaves the pending introduction fully usable until its five-minute expiry. This slice:

• PairingManager::cancel — bounded (sweeps expired entries like every other manager operation, no timers/threads) and idempotent (Cancelled / AlreadyCompleted / AlreadyTerminal). Cancelling a completed pairing is a no-op that preserves the enrolled device grant — no revocation, replay window untouched.
• Material removal — cancellation drops the transcript hash and pending device record immediately; enrollment and confirmation fail closed at once. No durable credential is ever created by a cancel path.
• No new mobile-visible state — a cancelled pairing tombstones until its original deadline, answering device callers exactly like an already-consumed pairing before the deadline and exactly like a naturally expired pairing (410) after it. Expiration and cancellation are indistinguishable to an untrusted mobile caller; no new mobile error code or scope was added.
• Owner-only daemon control — POST /api/v1/internal/mobile/pairings/{id}/cancel on the local (unix-socket) control plane only; the TLS gateway has no cancel route.
• Owner status — …/{id}/status now reports created / enrolled / partially_confirmed / completed / cancelled / expired (distinguishing waiting-for-device from waiting-for-confirmation) without exposing nonce, transcript, or device material; the phrase remains owner-visible only while its transcript exists.
• Audit — new coarse pairing_cancelled event (event name only, no pairing id / nonce / transcript material), emitted once per effective cancellation; idempotent repeats stay silent.
• Terminal pairing flow — the host decline path and the Ctrl-C interruption path (signal-safe atomic flag handler, same pattern as the daemon's termination handler) now attempt cancellation via the control route before exiting, and report the daemon's cancellation outcome.

Issue

Refs OpenCoven#814

Test plan

Local runs (checked = executed locally):

• rustfmt --edition 2021 --check on all four touched files (formatter only; no Rust build tooling per environment policy — cargo fmt/clippy/test deferred to CI)
• Manual secret-scan / privacy review of the diff (python unavailable locally): no secrets added; audit event and status DTO carry no nonce/transcript/device material; no new device-facing fields

Deferred to CI (unchecked = no Rust toolchain in the agent sandbox by policy):

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --locked
• python scripts/check-secrets.py
• python3 scripts/check-coven-privacy.py --staged

New focused tests: 8 unit tests in pairing.rs (cancel before enrollment / after enrollment / after one confirmation; repeated cancel idempotent + cannot resurrect; completed-pairing grant preserved; cancelled≡expired device-callable parity across the deadline; full lifecycle status; expiry status drops material) and 3 gateway tests (control-route cancel idempotent + audited once; device callers fail closed with existing error classes; cancelled ≡ consumed parity for device callers before the deadline).

Scope note

Single coherent slice covering all checklist items of OpenCoven#814 on the surfaces that exist today (the "TUI" host surface in this repo is the interactive coven mobile pair terminal flow — no other TUI pairing surface exists).

Vehicle note: opened in the fork CompleteDotTech/coven as the CI vehicle — this token cannot write to OpenCoven/coven. Re-target upstream once write access is restored. Refs OpenCoven#814.