Fix the VS Code extension getting 401 from the Sync API #718

The VS Code extension calls the sync inbox endpoint with no bearer token, but every inbox route now requires a paired device. Every call the extension makes is answered 401, so the extension can only ever show "cloud sync unavailable". Found in the 2026-09-27 repository review.

Context

src/App/Backlog.Ide.VsCode/src/extension.ts lines 42 and 73 call fetch(${url}/api/sync/inbox) with no Authorization header and no device-pairing flow. src/Modules/Sync/Backlog.Modules.Sync.Api/Endpoints/InboxEndpoints.cs line 29 maps the inbox group with .RequireAuthorization(SyncPolicies.PairedDevice), and Security/SyncAuthenticationExtensions.cs line 55 makes that policy the fallback. The doc comment at InboxEndpoints.cs line 15 still says "the editor extension" calls these routes.

Decide one of two outcomes and implement it:

1. Give the extension the same device flow the mobile client has: register via /devices/register, exchange the pairing code via /devices/token, persist the credential in the extension's secret storage, and send Authorization: Bearer on every inbox call. Handle 401 by prompting to re-pair.
2. Park the extension: make its command report that it is not yet paired-device aware, and remove the "editor extension" claim from the endpoint doc comment so the API documentation stops promising a client that cannot connect.

Either way, add a test in src/App/Backlog.Ide.VsCode (or a note in its README if the extension has no test harness) that pins the chosen behaviour. Route through delivery:flow-code per CLAUDE.md.