feat: show the device ID used for machine binding

[CallMeTechie]

Summary

Shows the device ID used for machine binding, so an admin can match it against the server's Users page ("Gerätebindung: gebunden an a41f09c2… seit …"), the same way the Android app does in its settings footer.

• Where: Settings → About, in the app card directly under the version line: Geräte-ID: a41f09c2… / Device ID: a41f09c2…, followed by a small hint (also shown as a tooltip): "Damit ordnet der Administrator die Gerätebindung zu." / "Lets your administrator match the device binding."
• Main → renderer: new app:device-id channel (registered in src/main/main.js next to locale:*), exposed in the preload as window.gatecontrol.getDeviceId(), following the app:version / getVersion() pattern. The main process returns only the first 8 lowercase hex characters of getMachineFingerprint() (core); the full 64-hex value never crosses into the renderer and is never logged.
• Failure path: if the fingerprint cannot be computed or is malformed, the channel returns null (a warning without the value is logged) and the UI shows "nicht verfügbar" / "unavailable". Nothing throws.
• Support bundle: the bundle now carries client.deviceId (short form, null if unavailable). This is done by passing a wrapped collector through the existing createSupportBundleSender(ctx, { collect }) seam, so no core change is needed.
• Copy button: not added. The client has no existing copy-button/clipboard pattern. The ID text is already selectable (.mono has user-select: text) so it can be copied by hand.
• Strings go through the client i18n files (de/en).

New module: src/main/device-id.js (shortDeviceId, withDeviceId).

Tests

• test/device-id.test.js: 8-char lowercase-hex result (also from uppercase/whitespace input), null for throwing/malformed fingerprints, the log line never contains the ID, support bundle gets client.deviceId (and null on failure).
• test/ipc-channels.test.js: the preload's getDeviceId() is served by main.js (covered by the existing channel check), main.js wires it to shortDeviceId(getMachineFingerprint, log), the real preload hands the renderer only the short value, preload/renderer never reference the fingerprint, and the failure path returns null.
• E2E: the "settings page opens" spec now also checks #about-device-id shows an 8-hex ID.
• Locally: npm test green (syntax check + 62 tests); the Playwright e2e app spec passed against electron . under xvfb, and a German screenshot of Settings → About was taken.

🤖 Generated with Claude Code

https://claude.ai/code/session_016xX1efcZF1f6G9rhmaJNLD

---

Generated by Claude Code