Removed devices: reset the device key and id in place, then set up again

DeviceKey implements kv-ffi's DeviceSigner.reset(): it deletes the key material
(TPM key, DPAPI file, Secret Service / keychain entry, or key file) and the
device-id and store files, then creates a new key with a new id in the best
store available. The core calls it on device_revoked and retries a setup code's
ticket once, so a fresh Add-a-device code signs a removed computer straight in.
DeviceRevoked explains how to set it up again; the fingerprint shown refreshes.
Removing a device warns that it must be set up again as a new one.

Test: end to end through kv-sync's test server (new dev-dependency).
The Windows TPM/DPAPI paths could not be compiled here (no Windows SDK for ring).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/main.ts

@@ -783,7 +783,7 @@ async function renderDevices(box: HTMLElement) {
     }
     if (!d.current) {
       actions.append(button(d.approved ? "Remove" : "Reject", "danger", () => confirmModal(`Remove “${d.name}”?`,
-        [p("kv-muted", "It will be signed out and can't sync again. Its local copy stays on it.")], "Remove device",
+        [p("kv-muted", "It will be signed out and can't sync again. Its local copy stays on it. To add it back later, set it up again as a new device.")], "Remove device",
         async () => { await invoke("revoke_device", { deviceId: d.device_id }); await reload(); }, true)));
     }
     list.append(h("div", "kv-frow",