A key present only in users.api_key_hash (never enrolled as a device) no longer authenticates. Per-device keys are individually revocable and listed on the devices panel; the old shared key was neither. migrateLegacyKeysToDevices() still seeds a legacy-shared device row from that column at every startup, so existing installs keep working once migrated. regenerateApiKey() is removed as dead code now that device-level rotation is revoke + enrol instead.