Tests: clean trusted-proxy pairing seed

src/gateway/server.auth.control-ui.suite.ts

@@ -251,7 +251,8 @@ export function registerControlUiAndPairingSuite(): void {
   test("clears self-declared scopes for trusted-proxy control ui without device identity", async () => {
     await configureTrustedProxyControlUiAuth();
     const { publicKeyRawBase64UrlFromPem } = await import("../infra/device-identity.js");
-    const { requestDevicePairing } = await import("../infra/device-pairing.js");
+    const { rejectDevicePairing, requestDevicePairing } =
+      await import("../infra/device-pairing.js");
     const { identity } = await createOperatorIdentityFixture("openclaw-control-ui-trusted-proxy-");
     const pendingRequest = await requestDevicePairing({
       deviceId: identity.deviceId,
@@ -261,6 +262,7 @@ export function registerControlUiAndPairingSuite(): void {
       clientId: CONTROL_UI_CLIENT.id,
       clientMode: CONTROL_UI_CLIENT.mode,
     });
+    try {
       await withGatewayServer(async ({ port }) => {
         const ws = await openWs(port, TRUSTED_PROXY_CONTROL_UI_HEADERS);
         try {
@@ -281,6 +283,9 @@ export function registerControlUiAndPairingSuite(): void {
           ws.close();
         }
       });
+    } finally {
+      await rejectDevicePairing(pendingRequest.request.requestId);
+    }
   });
 
   test("allows localhost control ui without device identity when insecure auth is enabled", async () => {