Account holders can now list, rename, and revoke their own devices (GET/PATCH/DELETE /devices) through the same multiUserMiddleware() that already authenticates sync traffic, separate from the ADMIN_TOKEN-gated /admin/devices surface. Revoking the device making the request is allowed: there is no session to invalidate mid-request, only a bearer key re-checked on every request, so the same key is rejected starting with its next use. users.js gains renameDevice(), the one device operation with no existing function. test.js adds HTTP-level coverage for /admin/devices (shaped after the existing /admin/mcp-grants block) and route-level coverage for the new account-holder routes against the real app, including cross- account isolation and the revoke-self outcome.