API: add PATCH /v1/devices/{id}/label for device-authenticated label update

The observer display name (label) was settable only at registration/recovery.
This endpoint lets the mobile app update it at any time using the device JWT.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: roman-dvorak

backend/apps/devices/api.py

@@ -13,6 +13,7 @@
 )
 from .models import ConsentRecord, Device, RecoveryPhrase
 from .schemas import (
+    DeviceLabelIn,
     DeviceRecoverIn,
     DeviceRecoverOut,
     DeviceRegisterIn,
@@ -90,6 +91,20 @@ def recover_device(request, payload: DeviceRecoverIn):
     return 200, {"device_id": str(device.id)}
 
 
+@router.patch("/{device_id}/label", auth=device_auth, response={200: SimpleOk, 403: dict})
+def update_label(request, device_id: str, payload: DeviceLabelIn):
+    """Update the display name (label) of the calling device.
+
+    The label is shown publicly on the web as the observer name. It can be set
+    on registration/recovery and changed at any time via this endpoint.
+    """
+    if str(request.device.id) != device_id:
+        return 403, {"detail": "Can only update your own label"}
+    request.device.label = payload.label.strip()[:120]
+    request.device.save(update_fields=["label"])
+    return 200, SimpleOk()
+
+
 @router.post("/{device_id}/revoke", auth=device_auth, response={200: SimpleOk, 403: dict})
 def revoke_device(request, device_id: str):
     """Revoke the calling device (must authenticate as itself)."""

backend/apps/devices/schemas.py

@@ -32,5 +32,9 @@ class DeviceRecoverOut(Schema):
     device_id: str
 
 
+class DeviceLabelIn(Schema):
+    label: str
+
+
 class SimpleOk(Schema):
     ok: bool = True