device leases: add track_serial and preserve leases across USB port renumbering #638

Refs #592.\n\n## Context\n\n#592 calls for device.lease(..., track_serial=True) so a lease can follow a physical USB device when Windows/macOS/Linux re-enumerates it under a different port name. The current DeviceManager keys leases by port only, so a Teensy-style COM21 -> COM20 move loses the authoritative holder association.\n\n## Acceptance\n\n- Device inventory records USB serial numbers when the OS exposes them.\n- Device lease records and public lease attribution include a rack_serial boolean, defaulting to false for compatibility.\n- POST /api/devices/{port}/lease accepts rack_serial; build device lease exposes a --track-serial flag.\n- On refresh, if a disconnected leased device has rack_serial=true and a newly discovered port has the same serial number, the daemon carries the lease state to the new port and records the previous port.\n- Device list/status responses include serial number and previous port when available.\n- Tests cover the COM renumbering case without relying on physical hardware.\n\nThis is the next #592 slice after structured disconnect events (#636); transparent WebSocket session rebind can build on this lease/inventory foundation.