Cover WS connect and peer-echo paths for device capabilities

Two coverage gaps spotted in review of the existing capabilities tests:

- WsFlowTest: open a WS handshake with the capabilities header and verify the device's stored set reflects it. The wiring lives in WsRoute, not HttpExtensions.verifyCaller, so the existing HTTP-only tests didn't reach it.

- DeviceFlowTest: two-device test where device 2 joins via share code with capabilities, device 1 reads them via the devices list endpoint. Pins the user-visible peer-echo contract that the client-side feature depends on.

Author: d4rken

src/test/kotlin/eu/darken/octi/server/device/DeviceFlowTest.kt

@@ -346,6 +346,27 @@ class DeviceFlowTest : TestRunner() {
         getDevices(creds).devices.single().capabilities shouldBe emptySet()
     }
 
+    @Test
+    fun `peer sees other device's capabilities via device list`() = runTest2 {
+        // End-to-end echo: device 2 joins with capabilities, device 1 reads them off the
+        // /v1/devices response. This is the user-visible contract the client-side feature
+        // depends on (peers learning each other's supported encryption modes).
+        val creds1 = createDevice()
+        val shareCode = createShareCode(creds1)
+        val creds2 = createDevice(
+            shareCode = shareCode,
+            capabilities = """["encryption:_reported","encryption:AES256_GCM_SIV"]""",
+        )
+
+        val devices = getDevices(creds1).devices
+        devices.size shouldBe 2
+        val peer = devices.single { it.id == creds2.deviceId }
+        peer.capabilities shouldBe setOf(
+            "encryption:_reported",
+            "encryption:AES256_GCM_SIV",
+        )
+    }
+
     @Test
     fun `auth failure with missing X-Device-ID is tracked`() = runTest2 {
         http.get(endPoint).apply {

src/test/kotlin/eu/darken/octi/server/ws/WsFlowTest.kt

@@ -108,6 +108,34 @@ class WsFlowTest : TestRunner() {
         wsClient.close()
     }
 
+    @Test
+    fun `connect with Octi-Device-Capabilities stores the capabilities`() = runWsTest {
+        // WS connect goes through the same touchAuthenticatedDevice path as HTTP, but the
+        // wiring is in WsRoute (not HttpExtensions.verifyCaller). Pin it here so the WS
+        // wire claim in the PR description is actually test-covered.
+        val creds = createDevice()
+        val wsClient = createWsClient()
+
+        wsClient.webSocket(
+            urlString = wsUrl(),
+            request = {
+                addCredentials(creds)
+                headers.append(
+                    "Octi-Device-Capabilities",
+                    """["encryption:_reported","encryption:AES256_GCM_SIV"]""",
+                )
+            },
+        ) {
+            close(CloseReason(CloseReason.Codes.NORMAL, "Test done"))
+        }
+
+        getDevices(creds).devices.single().capabilities shouldBe setOf(
+            "encryption:_reported",
+            "encryption:AES256_GCM_SIV",
+        )
+        wsClient.close()
+    }
+
     @Test
     fun `rate-limited authenticated connect still records client identity`() = runWsTest(
         appConfig = baseConfig.copy(