feat(openclaw-security-advisor) adds unique signup path

[St0rmz1]

Change the sign up URL to correctly attribute new signups

• src/auth/device-auth.ts — startDeviceAuth now constructs its own verification URL (${apiBase}/openclaw-advisor?code=...) instead of returning the server's generic /device-auth?code=.... Comment explains the cloud side uses the path prefix to attribute Security Advisor signups and apply a per-product bonus; older plugin builds still work but land on the generic URL without the bonus.
• README.md — Updated the documented signup URL to /openclaw-advisor.
• test/device-auth.test.ts (new) — Four bun:test cases:
  a. Ignores server's legacy URL and constructs the /openclaw-advisor one from the code
  b. Honors the caller-provided apiBase (dev loop via host.docker.internal)
  c. URL-encodes the code (defense-in-depth against malformed server responses)
  d. Throws a descriptive HTTP 500 error on server rejection

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• src/auth/device-auth.ts
• test/device-auth.test.ts

---

_{Reviewed by gpt-5.4-20260305 · 171,788 tokens}