feat: add Pi device agent installer + provisioning runtime

- Device agent runtime (Python): claim, poll approval, persist API key, heartbeat loop
- Systemd unit: timelapse-agent.service
- Installer script for Pi: install dependencies + enable service
- Provisioning support in API devices module:
  - claim endpoints
  - pending approval endpoints
  - bootstrap API key delivery
- Docs: device provisioning architecture + Pi agent README

Note: installer is intended to run on Pi/Linux only (not on macOS dev machine)

memory.md

@@ -131,6 +131,14 @@ docker compose up -d --build api-server web-dashboard worker
 - `apps/device-agent/requirements.txt`
 - `apps/device-agent/README.md`
 
+## Device installer (Pi) — ✅ ĐÃ LÀM
+- `apps/device-agent/agent/main.py`
+  - claim device, poll approval, save key, heartbeat loop
+- `apps/device-agent/systemd/timelapse-agent.service`
+- `apps/device-agent/scripts/install-agent.sh`
+- `apps/device-agent/requirements.txt`
+- `apps/device-agent/README.md`
+
 ## TODO — Phase tiếp theo
 1. **DB migration**: drizzle-kit push + seed data (trên Pi)
 2. **Role-based access control nâng cao** (org_admin/project_manager/viewer)