fix(devices): release pendingMu on the pending-status path of CheckRegistrationStatus

The mutex hardening added a fall-through 'pending' response path that
returned while still holding pendingMu — one status poll before approval
leaked the lock and every later register/approve/status request hung
forever (caught by TestDeviceRegistrationFlow's approve step hanging).

internal/handlers/devices.go

@@ -208,6 +208,7 @@ func (h *DeviceHandler) CheckRegistrationStatus(c *echo.Context) error {
 
 		return c.JSON(http.StatusOK, resp)
 	}
+	pendingMu.Unlock()
 
 	return c.JSON(http.StatusOK, DeviceAuthStatusResponse{
 		Status:    "pending",