v0.18.0 — /bootstrap-pairing for Automatic Pairing

Adds the inbound REST route the DeckWP dashboard's Automatic Pairing flow uses to push a pairing token into the connector. Auth via WP cookie + nonce + manage_options cap (NOT HMAC — by definition no secret yet). Delegates to the existing Pairing\Handler::pair() for the handshake.