docs: refresh CLI and trusted-proxy docs

docs/cli/devices.md

@@ -21,6 +21,25 @@ openclaw devices list
 openclaw devices list --json
 ```
 
+### `openclaw devices remove <deviceId>`
+
+Remove one paired device entry.
+
+```
+openclaw devices remove <deviceId>
+openclaw devices remove <deviceId> --json
+```
+
+### `openclaw devices clear --yes [--pending]`
+
+Clear paired devices in bulk.
+
+```
+openclaw devices clear --yes
+openclaw devices clear --yes --pending
+openclaw devices clear --yes --pending --json
+```
+
 ### `openclaw devices approve [requestId] [--latest]`
 
 Approve a pending device pairing request. If `requestId` is omitted, OpenClaw
@@ -71,3 +90,5 @@ Pass `--token` or `--password` explicitly. Missing explicit credentials is an er
 
 - Token rotation returns a new token (sensitive). Treat it like a secret.
 - These commands require `operator.pairing` (or `operator.admin`) scope.
+- `devices clear` is intentionally gated by `--yes`.
+- If pairing scope is unavailable on local loopback (and no explicit `--url` is passed), list/approve can use a local pairing fallback.