v0.17.1 - Fix OpenClaw device pairing on protocol 4

Fixes OpenClaw pairing after the protocol 4 bump in v0.17.0: the connect.challenge is now mandatory (15s window) instead of silently falling back to a device-less connect that the gateway rejects without creating a pending pairing request. Also signs the gateway's challenge timestamp (immune to HA clock drift) and upgrades to the v3 signature payload.

If you saw "No pending device pairing requests to approve" with v0.17.0, update, reload the OpenClaw profile, and the pairing request will appear.