v0.43.6

Fixed

• /api/setup now mints real tokens for unrecognised TRMNL clients. Tesserae was literally returning the string paste-a-server-issued-token-into-your-client as the api_key when an unknown device called /api/setup, which the official firmware stores locally and uses forever as its access token. Now mints a fresh short-form Tesserae token, records a Discovered entry pre-populated with the new token + MAC + Model + panel dims, and hands the real token back. Admin clicks Register and the device transitions from polling-with-real-token-unrecognised → polling-recognised with no firmware-side work. Matches the BYOS contract every official TRMNL variant follows.