feat(activate): allow retireDeviceId to free a device slot on migration

Supports client migration from per-user UUID to machine fingerprint without consuming an extra maxDevices slot.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/activate.test.mjs

@@ -162,6 +162,50 @@ void test('POST /v1/activate period key re-activation keeps same exp', async ()
   }
 });
 
+void test('POST /v1/activate retireDeviceId освобождает слот при миграции', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  writeData(
+    dataPath,
+    [
+      {
+        key: 'TTRPG-MIGRATE',
+        sub: 'lic_migrate',
+        pid: 'dnd_player',
+        maxDevices: 1,
+        expiresAtSec: 1893456000,
+      },
+    ],
+    { lic_migrate: ['legacy-user-uuid'] },
+  );
+
+  const server = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const blocked = await request(port, 'POST', '/v1/activate', {
+      body: { productKey: 'TTRPG-MIGRATE', deviceId: 'machine-fp-1' },
+    });
+    assert.equal(blocked.status, 403);
+    assert.equal(blocked.body.error, 'too_many_devices');
+
+    const res = await request(port, 'POST', '/v1/activate', {
+      body: {
+        productKey: 'TTRPG-MIGRATE',
+        deviceId: 'machine-fp-1',
+        retireDeviceId: 'legacy-user-uuid',
+      },
+    });
+    assert.equal(res.status, 200);
+    assert.equal(tokenPayload(res.body.token).did, 'machine-fp-1');
+
+    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
+    assert.deepEqual(data.activations.lic_migrate, ['machine-fp-1']);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 void test('POST /v1/activate period key second device shares license exp', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
   const dataPath = path.join(tmp, 'data.json');