[feat](alarm): store device ids as sha256 digests

device_id is a stable pseudonymous idempotency key, not a credential; a database dump should not be a usable list of device identifiers. Hash every caller-supplied value before it reaches the table, keep raw values out of logs and subscription views, and migrate existing rows with the identical SQL encoding.

src/realtime/auth.go

@@ -23,6 +23,7 @@ import (
 	"git.dcntrlized.org/Dcntrlized/Alarm/db"
 	"git.dcntrlized.org/Dcntrlized/Alarm/internal/alarmtoken"
 	"git.dcntrlized.org/Dcntrlized/Alarm/internal/apierr"
+	"git.dcntrlized.org/Dcntrlized/Alarm/internal/deviceid"
 	"git.dcntrlized.org/Dcntrlized/Alarm/logger"
 	"git.dcntrlized.org/dcntrlized/dcntrlized-auth/authclient"
 	"github.com/google/uuid"
@@ -135,7 +136,8 @@ func authenticateWS(r *http.Request) (*Identity, error) {
 // the alert.
 func resolveSubscription(r *http.Request, alertID, userID uuid.UUID) (*db.Subscription, error) {
 	if deviceID := strings.TrimSpace(r.URL.Query().Get("deviceId")); deviceID != "" {
-		return db.GetSubscriptionByDevice(r.Context(), alertID, userID, deviceID)
+		// The client sends the raw value; the row stores its digest.
+		return db.GetSubscriptionByDevice(r.Context(), alertID, userID, deviceid.Hash(deviceID))
 	}
 	ids, err := db.UserSubscriptionIDs(r.Context(), alertID, userID)
 	if err != nil {