fix: serve the device paths with or without a trailing slash

The panel's HTTP client does not follow redirects. It asks for
/api/setup/ with a trailing slash, Next answered 308 to normalise it,
and the firmware reported "returned code is not OK. Code - 308" and gave
up. Never having obtained a token, it then called /api/display with an
empty one, got 401, and told the user it could not reach the API.

Not TLS, not the network, not the port — a slash. Two earlier fixes were
aimed at hypotheses the evidence did not support: a certificate chain
the firmware genuinely cannot validate, and a port the shop's network
turned out not to block. Both were reasoned from silence, because
neither Traefik nor a production Next server logs requests by default.
The answer came from a packet capture, and from the device's own words.

/api/log now accepts a report from a panel that cannot authenticate.
Refusing it with a 401 threw away the one diagnostic that mattered: the
firmware was saying exactly what was wrong and we were discarding the
message. Nothing is stored — the rows would reference a device that does
not exist — but it reaches the server log, and the route was already
rate-limited.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd

app/api/log/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 
 import { authenticateDevice } from '@/lib/device/session';
-import { clientIp } from '@/lib/device/headers';
+import { clientIp, deviceHeader } from '@/lib/device/headers';
 import { checkTransport } from '@/lib/device/transport';
 import { prisma } from '@/lib/db';
 import { rateLimit } from '@/lib/ratelimit';
@@ -34,8 +34,21 @@ export async function POST(request: Request) {
   }
 
   const device = await authenticateDevice(request);
+
   if (!device) {
-    return NextResponse.json({ error: 'Jeton invalide' }, { status: 401 });
+    // A panel that cannot authenticate is precisely the panel whose own
+    // account of the failure is worth having. Refusing it with a 401 threw
+    // away the one diagnostic that mattered here: the firmware was reporting
+    // a 308 on /api/setup/, and we discarded the message saying so.
+    //
+    // Nothing is stored — the rows are tied to a device that does not exist —
+    // but it reaches the server log, where `docker compose logs app` will show
+    // it. The route is rate-limited above, so this is not an open write.
+    const body = await request.text().catch(() => '');
+    console.warn(
+      `[device] journal d'un appareil non authentifié (ID: ${deviceHeader(request, 'id') ?? 'absent'}) : ${body.slice(0, 1000)}`,
+    );
+    return new NextResponse(null, { status: 204 });
   }
 
   let entries: IncomingLog[] = [];