Pairing: replace the code-derived room id with a PAKE (or a QR-carried secret) so a hostile node cannot brute-force the pairing code offline

[SecureCloudGroup]

Today the pairing room id is PBKDF2(code, fixed salt) (app/smartbrain_3000/pairing_code.py, mirrored in web/src/lib/remote/paircode.ts). A malicious signaling node sees the room id and can search the code space offline; v0.9.35 raised the code to 8 characters (31^8 ≈ 2^39.6, ≈2^58 SHA-256 with 300k rounds) — a cost, not an impossibility. The session protocol after pairing is unaffected (pinned Ed25519 key + DTLS channel binding).

Two designs to weigh:

1. QR carries a 128-bit session secret (the QR is currently origin-only — the fragment was removed in fix(models,pair): remove the routing slots that routed nothing, and the retired QR-payload path #200 for the iOS install flow; that history must be re-checked first). The typed code stays as the manual fallback.
2. A PAKE (SPAKE2/OPAQUE) over the code, with a room id that is not a function of the code alone.

Done means: a broker that records every message of a pairing cannot recover the pairing payload without an online guess bounded by the 8-guess cap; documented in docs/08 "Two honest limits" with the limit removed.