fix(ui): key the rotation callout to an observable symptom

"If it can only sign in with its device token" asked the operator to know which
credential the device holds, which is internal state they cannot see. The
condition is now the symptom that state produces: the device does not come back
on its own. Same behavior, same technical truth, decidable from the Devices page.

ui/src/i18n/locales/en.ts

@@ -602,7 +602,7 @@ export const en: TranslationMap = {
       rotateWithheldTitle: "Token rotated · {device}",
       rotateWithheldNext:
         "It will reconnect with the new token automatically — nothing else to do.",
-      rotateWithheldException: "If it can only sign in with its device token, pair it again.",
+      rotateWithheldException: "If it doesn't reconnect on its own, pair it again.",
       rotateWithheldNote: "For security, the new token is only revealed on the device itself.",
       gateway: "gateway",
       unpaired: "unpaired",

ui/src/pages/devices/devices-page.test.ts

@@ -489,7 +489,8 @@ describe("DevicesPage gateway lifecycle", () => {
     );
     expect(document.body.textContent).toContain("Mac Studio");
     expect(document.body.textContent).toContain(t("devices.inventory.rotateWithheldNext"));
-    // The one actionable branch is a callout, not a fourth sentence in the calm block.
+    // The one actionable branch is a callout, keyed to a symptom the operator can see
+    // rather than to which credential the device happens to hold.
     expect(document.body.querySelector(".secret-reveal__callout")?.textContent).toContain(
       t("devices.inventory.rotateWithheldException"),
     );