Move device creation from AuthProvider to broker.

[floitsch]

The auth provider no longer mints device records. Instead, the CLI mints a hardware-id locally and the broker's notify-created is responsible for any further side effects.

Server tenancy:

• ServerConfig grows an optional tenancy/string? field plus constants TENANCY-SHARED and TENANCY-DEDICATED. The field marks whether a server is a multi-tenant deployment that shares its underlying storage with an auth provider (and so must mint auth-side records when registering devices) or a self-contained single-tenant deployment.
• ServerConfigSupabase gains a 'with --tenancy/string' clone to set tenancy without touching other fields.

Broker:

• BrokerCli.notify-created now takes --hardware-id alongside --device-id and --state. Callers mint the hardware-id locally (random-uuid) instead of relying on the auth provider.
• BrokerCliSupabase overrides notify-created: when tenancy is TENANCY-SHARED, it inserts a row into the auth-side 'devices' table (same Supabase project) before delegating to super. Other tenancies skip the cross-table write.

CLI:

• Fleet.provision mints a fresh hardware-id and calls broker.notify-created. The artemis.create-device call is gone.
• The Artemis wrapper no longer exposes create-device.

Deletions:

• AuthProvider.create-device-in-organization (interface + Supabase + HTTP impls).
• COMMAND-CREATE-DEVICE-IN-ORGANIZATION_ constant and its string mapping.
• tools/http_servers/artemis-server.toit handler and the leftover devices state.
• ArtemisServerBackdoor.create-device (test backdoor) and its impls in tests/artemis-server.toit.
• test-create-device-in-organization in tests/auth-provider-test.toit.

Tests:

• BrokerBackdoor.create-device gains --hardware-id; SupabaseBackdoor mirrors the shared-tenancy cross-table insert; ToitHttpBackdoor ignores the new arg.
• tests/broker.toit's with-broker tags the Supabase-artemis test broker with TENANCY-SHARED and attaches TEST-SCOPE to the backdoor's config (the TestBroker's server-config stays scope-less because it doubles as a global-config entry).
• HTTP test broker server (tools/http_servers/public/broker/broker.toit) rejects duplicate notify-created (the auth-side uniqueness check no longer guards it on the CLI's behalf).
• tests/utils.toit's create-device_ mints hardware-id locally and goes through broker.backdoor only.