Separate shared gateway auth from cached device-token signing in Control UI browser auth. Preserves shared-token validation while keeping cached device tokens scoped to signed device payloads. Co-authored-by: Frad LEE <fradser@gmail.com>