Function create_device 

pub fn create_device(
    conn: &Connection,
    user_id: i64,
    credential_kind: CredentialKind,
    credential_ref: &str,
    now: &str,
) -> Result<String>

Mint a fresh device for user_id authenticated by (credential_kind, credential_ref), returning the new device id. Does not check for an existing row for this credential — callers use device_for_credential first (the get-or-create orchestration is P4’s device_id_for, not this module’s job).