feat(namespace): add device auto-accept setting

[danielgatis]

Motivation

In controlled environments, operators may want every device that attempts
to connect to be automatically accepted without manual intervention.
This removes the need to periodically visit the pending devices list,
making the workflow less bureaucratic and improving the day-to-day
experience for operators who trust their network.

Summary

• Add device_auto_accept boolean to namespace settings
• New devices are automatically accepted when the setting is enabled
• Dedicated PUT /api/namespaces/device-auto-accept/:tenant route with
  NamespaceDeviceAutoAccept permission (owner + administrator)
• Postgres migration adds device_auto_accept column to namespaces
• Auto-accept logic runs inside AuthDevice on first device registration
• Toggle UI in Settings page with permission gating
• Setting visible/editable in admin namespace drawer and details view

Closes #4091

Test plan

• Enable setting in Settings → Devices → Auto-Accept: On
• Connect a new agent — device appears as accepted, not pending
• Disable setting — next new device goes to pending
• Observer/Operator roles cannot toggle the setting (403)
• go test ./api/services/... ./api/routes/... ./pkg/api/authorizer/...

[otavio]

/review

[github-actions]

Claude finished @otavio's task in 4m 37s —— View job

---

Code Review Complete

Reviewed 22 files across code quality, security, testing, Go/TypeScript patterns, and architecture. 2 inline issues posted (2 high).

Additional notes

Cross-repo impact — cloud admin NamespaceUpdate will reset DeviceAutoAccept to false:
The cloud admin endpoint at cloud/internal/admin/services/namespace.go:68-71 explicitly copies Name, SessionRecord, ConnectionAnnouncement, and MaxDevices from the incoming request to the stored namespace — but does not copy DeviceAutoAccept. Since the Go zero value for bool is false, every admin namespace edit (e.g., changing the name or max devices) will silently reset DeviceAutoAccept to false. The EditNamespaceDrawer.tsx sends device_auto_accept in the body, but it's ignored because the cloud service doesn't read it. This is a data-loss bug that needs a one-line fix in the cloud repo:

// cloud/internal/admin/services/namespace.go, after line 70:
ns.Settings.DeviceAutoAccept = namespace.Settings.DeviceAutoAccept

---

If you've addressed the feedback and want a new review, tag @shellhub-io/admin and a team member can trigger it.

[danielgatis]

@otavio could i get another /review round? 👋

[github-actions]

@danielgatis You are not authorized to request an explicit review. If you believe this PR needs a new automated review round, please tag the @shellhub-io/admin team and a team member can trigger it.

[otavio]

/review

[github-actions]

Claude finished @otavio's task in 51s —— View job

---

Code Review Complete

Reviewed 24 files across code quality, security, testing, Go/TypeScript patterns, and architecture. 1 inline issue posted (1 high).

Additional notes

Previous review issues addressed: Both issues from the first review round (the DeviceUpdate clobbering auto-accept status on re-registration, and the "Off" button styling) have been fixed in this revision.

Cross-repo impact (unchanged from previous review): The cloud admin NamespaceUpdate at cloud/internal/admin/services/namespace.go:68-71 still does not copy DeviceAutoAccept from the incoming request. The EditNamespaceDrawer.tsx added a checkbox for this field, but the cloud backend ignores it — toggling auto-accept from the admin panel will silently do nothing. A one-line fix is needed in the cloud repo:

ns.Settings.DeviceAutoAccept = namespace.Settings.DeviceAutoAccept

---

If you've addressed the feedback and want a new review, tag @shellhub-io/admin and a team member can trigger it.

[otavio]

/review

[github-actions]

Claude finished @otavio's task in 7s —— View job

---

Code Review Complete

Reviewed 24 files across code quality, security, testing, Go/TypeScript patterns, and architecture — no issues found.

Previous review issues addressed: All three issues from prior rounds have been fixed in this revision:

1. DeviceUpdate clobbering auto-accepted status on re-registration (auth.go) — fixed with in-memory status sync
2. "Off" button styling mismatch (Settings.tsx) — fixed with correct neutral style
3. omitempty on DeviceAutoAccept BSON tag (namespace.go) — removed so false persists correctly

Cross-repo impact (unchanged from previous reviews): The cloud admin NamespaceUpdate at cloud/internal/admin/services/namespace.go:68-71 still does not copy DeviceAutoAccept from the incoming request. The EditNamespaceDrawer.tsx added a checkbox for this field, but the cloud backend ignores it — toggling auto-accept from the admin panel will silently do nothing. A one-line fix is needed in the cloud repo:

ns.Settings.DeviceAutoAccept = namespace.Settings.DeviceAutoAccept

---

If you've addressed the feedback and want a new review, tag @shellhub-io/admin and a team member can trigger it.