feat(stats): per-device reading breakdown + device attribution on progress syncs

- Attribution: registered clients may now send their device token in
  X-Device-Token on PUT /api/media-items/:id/progress (the user JWT
  stays primary). The token must map to a device OWNED BY the caller —
  foreign/invalid/absent tokens soft-fail to plain web attribution so a
  stats decoration can never break a sync. Attributed pushes capture
  device_id (FK-safe), device_metadata.source = the registered device
  name ('Pixel 9', 'Kindle Paperwhite'), and last_sync surfaces show
  that device. Side effect worth having: app-vs-web pushes used to be
  LWW-invisible (both sources read 'web'); they now surface as
  legitimate cross-source progress conflicts when they diverge.
- /stats gains a By Device panel alongside By Library (grid 3-wide):
  reading minutes + sessions + books per registered device, plus one
  Web / unsynced bucket for device-less pushes so the panel always
  reconciles with the headline totals. Range-aware, family-lens
  scoped; renderBars shared between panels in stats.ts.
- The device identity IS the registered platform: devices rows already
  carry the name/type the client registered (app sends Build.MODEL +
  'mobile' at /api/devices/register, KOReader/Kobo likewise) — no new
  identity plumbing on the server.

Tests: capture attributed to the device (row device_id + source
metadata + last_sync_source), foreign/nonexistent tokens soft-fail,
device buckets reconcile (80 attributed + 75 unsynced = 155 total).
Full suite PASS.

templates/stats.templ

@@ -68,13 +68,20 @@ templ Stats(user User) {
 						</div>
 					</div>
 				</div>
-				<div class="grid grid-cols-1 lg:grid-cols-2 gap-6 mb-8">
+				<div class="grid grid-cols-1 lg:grid-cols-3 gap-6 mb-8">
 					<div class="card p-6">
 						<h3 class="text-sm font-semibold uppercase tracking-wide mb-4" style="color: var(--text-secondary)">By Library</h3>
 						<div id="stats-library-breakdown" class="space-y-3">
 							<div class="text-center py-6 text-sm" style="color: var(--text-secondary)">Loading…</div>
 						</div>
 					</div>
+					<div class="card p-6">
+						<h3 class="text-sm font-semibold uppercase tracking-wide mb-4" style="color: var(--text-secondary)">By Device</h3>
+						<p class="text-xs mb-3" style="color: var(--text-secondary)">Where the sync pushes came from — registered device names, or "Web / unsynced" when the push carried no device credential.</p>
+						<div id="stats-device-breakdown" class="space-y-3">
+							<div class="text-center py-6 text-sm" style="color: var(--text-secondary)">Loading…</div>
+						</div>
+					</div>
 					<div class="card p-6">
 						<h3 class="text-sm font-semibold uppercase tracking-wide mb-4" style="color: var(--text-secondary)">Most Read</h3>
 						<div id="stats-top-books" class="space-y-3">