Attest Register

Verify a fresh attestation and upsert the device's App Attest key.

Idempotent: a re-register with the same key_id overwrites the existing row (the public key is deterministic for a given key id, so a "different key" would have failed Apple's attestation check).