v1.0.28

• The device API's Error.code list no longer names organization_required, forbidden, conflict and already_member: only the dashboard tree (/partner) answers them, never /v1. The CLI still meets them on its own /partner calls and keeps their exit codes (organization_required 1, the other three 2), now from a list of its own. Nothing changes for a script that reads --json or the exit code.