BOLT-1322 [4-NEW] apps/api: REST route POST /v1/commands/vehicle/check-pairing-status (sync)

New REST endpoint mirroring the existing /v1/commands/* pattern, but executes SYNCHRONOUSLY — no Kafka, no command.issued event published, returns the actual keyPaired value in the response. Location: apps/api/src/routers/v1/commands/post.commands/vehicle/check-pairing-status/ - index.ts (handler) - schema.ts (request/response zod schemas, OpenAPI registration) - __tests__/index.test.ts (unit tests) Mirror the file structure of: apps/api/src/routers/v1/commands/post.commands/vehicle/set-charge-limit/ (see existing file layout there for handler + schema + OpenAPI patterns) Endpoint contract: POST /v1/commands/vehicle/check-pairing-status Auth: standard apiKey / scopedKey middleware Body: { deviceOnWorkspaceId: string } (consistent with other /v1/commands/vehicle/* endpoints) 200 Response: { success: boolean, command: { id, type, status, output, createdAt, ... }, // Command audit row keyPaired: boolean | null, applicable: boolean, extendedCapabilities?: Record<string, unknown>, manufacturer: string, stale?: boolean, // true when we fell back to staticState on adapter error } 400/403/404: standard Handler flow: 1. Authorize: canUpdate the device (matches other /commands/* — Amazon sending a command-shaped request). 2. Call NEW device-domain GraphQL mutation refreshVehicleKeyPairing(deviceOnWorkspaceId) — see task [5-NEW]. The mutation does ALL the work (manufacturer detection, adapter call, Command row, staticState upsert). 3. Map GraphQL response → REST DTO. Tests in this PR (light unit-level): - handler maps GraphQL response correctly - handler converts GraphQL errors to correct HTTP status E2E tests live in [7/7]. Branch: havoc/bolt-1322-rest-route Worktree: ../mono-bolt-1322-rest-route Depends on: [1/7] [3/7] [5-NEW] Done when: route registered, OpenAPI spec validates, unit tests pass.