Harden Dingtian: authenticated binary relay + disable unused channels

Lock down the relay device for the flat (no-VLAN) network.

Relay control:
- pulseOpen/setRelay now use the Dingtian BINARY protocol (:60000) with a
  relay password — the only relay option with auth (string :60001 has none, and
  is kept only for the read-only status query). Frame verified on hardware.

HardenableDevice capability (driver harden()):
- set a random relay_pw (1-9999); disable unused channels (rs485/can/tcp x2/mqtt
  -> p:255), keeping UDP1 binary (control) + UDP2 string (status).
- write-verified (device reboots on apply).

Assign/Save flow now does: fix preconditions -> harden -> set up input push;
the relay password is stored in lane_devices so the runtime device can command
the relay.

DELIBERATELY NOT touching the device's HTTP CGI session check (session_en):
enabling it on this firmware breaks the config-READ API (ECONNRESET) and locked
the backend out — required a factory reset to recover. The open CGI API is
accepted as flat-network reality; the signed event log is the real guarantee.

Verified end to end on hardware: assign hardens + configures the device, config
API stays reachable, pulseOpen with the stored password fires the relay, without
it is rejected. wiki: device-input-flow + dingtian-relay updated.

wiki/log.md

@@ -174,3 +174,21 @@ button. Verified in-browser against the real device: Test shows ● ready +
 preconditions OK; Save persists the row AND writes the device's Input Link URL
 (push path matches the saved device id). Admin never logs into the device web UI.
 Updated [[first-run-setup]].
+
+## [2026-06-15] feature | Device hardening: binary relay + relay_pw + disable channels
+Hardened the Dingtian relay control for the flat (no-VLAN) network. Switched
+pulseOpen from the unauthenticated string protocol (:60001) to the **binary
+protocol (:60000) with a relay password** — the only authenticated relay option
+(frame verified on hardware: FF AA <sess> 03 <pwLE> <relayByte> <jogLE>). New
+HardenableDevice capability: harden() sets a random relay_pw + disables unused
+channels (rs485/can/tcp×2/mqtt → p:255, keep UDP binary+string). Folded into the
+assign/Save flow (preconditions → harden → push); relayPassword stored in
+lane_devices. Verified end to end: assign configures + hardens the device, config
+API stays reachable, pulseOpen with the stored password fires the relay, without
+it is rejected.
+
+⚠️ LESSON: enabling the device's HTTP CGI session check (session_en) on this
+firmware breaks the config-READ API (ECONNRESET) — locked us out, needed a FACTORY
+RESET to recover. harden() deliberately does NOT touch session_en. The open CGI
+API is accepted as flat-network reality; the signed log is the real guarantee.
+Recorded in [[device-input-flow]] + [[dingtian-relay]].