feat(server): 待审核直接拒绝、设备数量上限与黑名单

[loyalpartner]

Follow-up to #15, addressing the concerns raised in #13.

• Pending and blocklisted devices are refused without any DB write; turning approval off no longer lets pending devices in.
• New device limit (admin page, default 20, range 1–1000). Once approved + pending devices reach it, unknown devices are refused and not recorded. Blocklisted devices don't count.
• client_id must be ≤ 64 base64 chars and email ≤ 254 chars; anything else is refused without a write.
• Admin page: device limit setting, "Rejected" renamed to "Blocklist" with Unblock (forget the row) and Approve, Clear pending, and a resume hint after approval.
• No new table: blocklist is the existing rejected status, the limit lives in settings.device_limit.

Refs #13

🤖 Generated with Claude Code

[berglh]

This looks like a much more complete design for my particular use case. I really appreciate your efforts to address my comments. I will test this in the coming days. ♥️