Fix board registration blocked by HMAC auth

- /register endpoint no longer requires verifyAPIRequest() - it is
  the bootstrap handshake and api_secret cannot be set before it runs
- Add api_secret field to the Add Board form (hardware boards only)
  with a cryptographic Generate button, same as the Edit form
- Save api_secret from the add-board POST so the driver can sign
  requests immediately after registration

app/routes/boards.py

@@ -75,6 +75,8 @@ def add_board():
             num_relays = 0
             num_inputs = 0
 
+        api_secret = request.form.get("api_secret", "").strip() or None
+
         board = Board(
             name=name,
             board_type=board_type,
@@ -82,6 +84,7 @@ def add_board():
             port=port,
             num_relays=num_relays,
             num_inputs=num_inputs,
+            api_secret=api_secret,
         )
         db.session.add(board)
         db.session.commit()