docs(user): pairing-code flow for device setup guides

The setup guides walked the retired broadcast-list approve ("your device
appears under Pending Device Registrations — click Approve"), which no
longer exists. Both now describe the pairing-code flow: the e-reader
displays a 6-digit code, you type it into Pair a Device on your own
account, and only whoever holds the device can read the code — the
family-server gap that motivated the change. Adds a Pairing Code Not
Accepted troubleshooting case, refreshes the security practices
(claim only codes you can see on a device you are holding), and aligns
the remaining approval/pending wording throughout.

docs/user/sync-guide.md

@@ -17,9 +17,14 @@ notes — and every registered device pushes and pulls against it.
 ## Getting a device into the circle
 
 1. Connect the device to your server (each guide above walks its own path)
-2. Approve the pending registration on the **Devices** page — the Android
-   app registers itself on first login; KOReader asks from its plugin
-3. Done. Sync starts as soon as a device is approved
+2. Pair it on the **Devices** page — the Android app registers itself on
+   first login; KOReader shows a 6-digit pairing code that you type into
+   **Pair a Device** on the page
+3. Done. Sync starts as soon as a device is paired
+
+Only the person holding the device can read its pairing code, so a device
+always lands in the account of whoever registered it — even on a family
+server where more than one person is logged in.
 
 The **Devices** page is mission control: see every registered device and
 when it was last seen, remove a device (revoking its access instantly), and
@@ -61,7 +66,7 @@ phone lands in the right place on an e-reader with different pagination.
 **Bookmarks** — location, title, and when you made them.
 
 Everything above is per-user and private: your devices see your data
-because you approved them, other users see theirs, and revoking a device
+because you paired them, other users see theirs, and revoking a device
 ends its access on the spot.
 
 ## Conflicts
@@ -98,13 +103,13 @@ alone.
 ## Troubleshooting
 
 **Progress not updating**
-Check the device is still on the **Devices** page and was approved; check
+Check the device is still on the **Devices** page and was paired; check
 the server URL in the device's settings; confirm the device can reach the
 server (open the server URL in the device's browser as a test).
 
 **"Device not found"**
 The device was removed or its token revoked — register it again and
-approve it.
+enter the fresh pairing code.
 
 **A conflict keeps coming back**
 Two devices are genuinely fighting over the same book. Decide which device