The device identity check was rejecting connections before token
authentication could be attempted. This broke the control-ui (web UI)
which uses token-based authentication via URL parameter.
Changes:
- Skip device identity requirement when a token is provided
- Guard device token verification to only run when device is present
Fixes control-ui showing "device identity required" error when
connecting with a valid token.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
