Remember across a restart that a token was minted here

[matuszeg]

Closes #30.

LocalAuth lived only in PumpspyRuntime, so a restart forgot that a token had
been minted. Restart during an outage and
binary_sensor.pumpspy_local_local_token_issued read off while the device was
still carrying a token this integration issued, denying responsibility for the
vendor rejections it exists to explain.

What changed

The issued_at timestamp is persisted through the same Store that already
holds device state, and restored during setup. The token value is not, and
test_the_token_itself_is_never_written_down holds that line: relaying the
device's credential is the job, keeping a copy of it isn't.

One thing the issue didn't mention, and without it none of this would have
worked: request_save() was only ever called from _record, so a mint was
never written out on its own. _handle_auth now asks for the save on both mint
and clear. The mint case matters because the event that causes an outage is
often the same sort of event that takes the machine down with it. The clear case
matters because otherwise the sensor sticks on after recovery.

The staleness call

A stored record older than four hours is discarded rather than restored. That is
the device's own re-authentication interval, measured on 2026-08-20 and
2026-08-21, so if Home Assistant was down for longer the shim sent the device to
the vendor and it is holding a real token now. Restoring the flag at that point
would claim credit for rejections that aren't ours, and inventing a signal is a
worse fault in a diagnostic than the silence this replaces.

It rarely bites in practice. During an outage the device asks again roughly every
nine minutes, and every mint restamps the record.

Verification

Ten new tests covering the round trip, both directions of the staleness window,
an unreadable timestamp, storage written by an older version, and the entity
reading on after a full unload and setup cycle.

Then driven on a running instance rather than trusted to the tests, since this
sits behind the request handler. The dev upstream is refused by design, so the
vendor verdict goes down on its own, a token request mints, and after a restart:

INFO ... the device may still be carrying a token minted here at 2026-08-25 00:20:49.330180+00:00

with only {"issued_at": "..."} on disk and no UUID anywhere in the storage file.

239 tests pass.