Bug Description

After restarting the Gateway service, CLI commands fail with "pairing required" error, but the CLI itself cannot approve devices because it also requires pairing. This creates a circular dependency.

Steps to Reproduce

1. Configure OpenClaw with gateway.mode=local and gateway.bind=loopback
2. Run openclaw gateway restart
3. Try to run any CLI command (e.g., openclaw devices list)
4. Observe error: gateway closed (1008): pairing required
5. Cannot approve the device because approval command also requires Gateway connection

Expected Behavior

• Local loopback connections (127.0.0.1) should be auto-approved as documented
• OR: CLI should have a way to bootstrap device approval after Gateway restart

Actual Behavior

gateway closed (1008): pairing required
Gateway target: ws://127.0.0.1:63639
Source: local loopback

Environment

• OpenClaw version: 2026.2.19-2
• OS: Linux 6.17.0-14-generic (x64)
• Node: v22.22.0
• Gateway config: bind=loopback, auth.mode=token

Logs

security audit: device access upgrade requested reason=scope-upgrade 
device=80c843da... ip=unknown-ip auth=token roleFrom=operator 
roleTo=operator scopesFrom=operator.read scopesTo=operator.admin

Workaround

None found. Browser Control UI also requires pairing, creating a deadlock.

Suggested Fix

1. Auto-approve local loopback connections for CLI (as documented)
2. OR: Provide a --force-local flag to bypass pairing for localhost
3. OR: Persist device approvals across Gateway restarts