v0.4.9 — Defensive device_authorize refresh on retry

Minor defensive fix: after force_reauth the retry now re-reads device_authorize from the coordinator data. Control buttons still require the correct write API endpoint to be discovered — see README / issue tracker.