User and Device Registration

Endpoints for registering users and linking their device's Secure Enclave key to their account. Device registration uses a challenge-response flow to prove key possession, with optional face verification when the user already has biometrics enrolled.

Method	Endpoint	Description
POST	/auth/users/register	Register a new user from their JWT identity
GET	/auth/devices/challenge/:device_verifying_key	Get a short-lived challenge for device key proof
POST	/auth/devices/register	Register a device's public key; requires face if user has biometrics