Standardize the pairing token format

[maximmaxim345]

Defines the pairing token: the single SP:-prefixed, versioned, base32 string that distributes a client's static key and its Sendspin Pairing PSK together for the Pairing PSK flow. This standardizes the format that aiosendspin's pairing_token.py already produces and consumes, so tokens interoperate across implementations.

Also, I defined the scheme for the QR code, which we previously mentioned but never elaborated: it's the token string carried verbatim, with no URI wrapper, so a scan and a copy/paste yield identical input.

The wire format matches aiosendspin exactly. What the spec adds on top:

• Case-insensitive, lenient decoding is now a normative requirement (trim, upper-case, then strip the optional SP: prefix). While aiosendspin already behaves this way, this requires it.
• A MUST that the server confirm the decoded client_key matches the connection's client_id before pairing, which the library doesn't state.