Convert Sendspin pairing to the spec's pairing-code dialect

[teancom]

What does this implement/fix?

Pairing methods are now dynamic_pairing_code/static_pairing_code with format descriptors (digits/qr_code) instead of the old PIN dialect's negotiated lengths. The provider selects the digits format, rejects QR-only clients with a localized error, and presents fixed-length forms: six digits (###-###) for dynamic codes and eight (####-####) for static. All pin_* naming in the provider and tests is renamed to pairing-code terms; MA-internal config/form option keys keep their persisted values.

Currently points at a branch of aiosendspin, which is why I'm opening it as a DRAFT. If/when the aiosendspin PR is merged and released, I'll update this PR to use it (and rebase and cleanup the inevitable merge conflicts by then).

Types of changes

• Bugfix (non-breaking change which fixes an issue) — bugfix
• New feature (non-breaking change which adds functionality) — new-feature
• Enhancement to an existing feature — enhancement
• New music/player/metadata/plugin provider — new-provider
• Breaking change (fix or feature that would cause existing functionality to not work as expected) — breaking-change
• Refactor (no behaviour change) — refactor
• Documentation only — documentation
• Maintenance / chore — maintenance
• CI / workflow change — ci
• Dependencies bump — dependencies

Checklist

• The code change is tested and works locally.
• pre-commit run --all-files passes.
• pytest passes, and tests have been added/updated under tests/ where applicable.
• For changes to shared models, the companion PR in music-assistant/models is linked.
• For changes affecting the UI, the companion PR in music-assistant/frontend is linked.
• I have read and complied with the project's AI Policy for any AI-assisted contributions.
• I have raised a PR against the documentation repository targeting the main or beta branch as appropriate.

[teancom]

The aiosendspin PR.

[codspeed-hq]

Merging this PR will not alter performance

✅ 11 untouched benchmarks
⏩ 7 skipped benchmarks¹

---

_{Comparing test/aiosendspin-pairing-code (521a768) with dev (12dc308)}

Footnotes

1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[github-actions]

🔒 Dependency Security Report

📦 Modified Dependencies

music_assistant/providers/sendspin/manifest.json

Added:

• ✅ aiosendspin [server] @ git+https://github.com/Sendspin/aiosendspin@90feb19894793749eb017f9e1bb21929dc8fe94a

Removed:

• ❌ aiosendspin [server]==9.1.1

Unchanged dependencies

• av ==16.1.0

The following dependencies were added or modified:

diff --git a/requirements_all.txt b/requirements_all.txt
index 025e760cc..5f4b8307c 100644
--- a/requirements_all.txt
+++ b/requirements_all.txt
@@ -13,7 +13,7 @@ aiohttp-socks==0.11.0
 aiojellyfin==0.14.1
 aiolibdatachannel @ git+https://github.com/music-assistant/aiolibdatachannel@feat/certpem-testdrive
 aiomusiccast==0.15.0
-aiosendspin[server]==9.1.1
+aiosendspin[server] @ git+https://github.com/Sendspin/aiosendspin@90feb19894793749eb017f9e1bb21929dc8fe94a
 aioslimproto==3.1.9
 aiosonos==0.1.12
 aiosqlite==0.22.1

New/modified packages to review:

• aiosendspin[server] @ git+https://github.com/Sendspin/aiosendspin@90feb19894793749eb017f9e1bb21929dc8fe94a

---

🔍 Vulnerability Scan Results

No known vulnerabilities found

Name	Skip Reason
aiolibdatachannel	Dependency not found on PyPI and could not be audited: aiolibdatachannel (2026.5.23.dev4+g950e7f0)
aiosendspin	Dependency not found on PyPI and could not be audited: aiosendspin (0.0.0)
torch	Dependency not found on PyPI and could not be audited: torch (2.13.0+cpu)
torchaudio	Dependency not found on PyPI and could not be audited: torchaudio (2.11.0+cpu)

✅ No known vulnerabilities found

---

Automated Security Checks

• ✅ Vulnerability Scan: Passed - No known vulnerabilities
• ✅ Trusted Sources: All packages have verified source repositories
• ✅ Typosquatting Check: No suspicious package names detected
• ✅ License Compatibility: All licenses are OSI-approved and compatible
• ✅ Supply Chain Risk: Passed - packages appear mature and maintained

Manual Review

Maintainer approval required:

• I have reviewed the changes above and approve these dependency updates

To approve: Comment /approve-dependencies or manually add the dependencies-reviewed label.