Start a device-bound passkey import (native apps)

Issues the challenge for importing a hardware-bound key (Secure Enclave / Android Keystore) as a passkey. The app must bind this exact challenge into its attestation — Android setAttestationChallenge(challenge bytes) at key generation; iOS App Attest with clientDataHash = SHA-256(proof.clientData bytes), where the proof document embeds the challenge, the subject, the credential id and the public key hash — and into the proof it signs for /passkey/import/complete. Requires 'passkey' in the application's allowedScaMethods and a deviceAttestation configuration for the platform (else 100010). The two-passkey cap applies (100004). The challenge lives 10 minutes and is single use. — Requires an active SCA session granted within the last 15 minutes, else 30070 (SCA_REQUIRED) with reason NO_SESSION or EXPIRED, exactly as the SCA-gated reads report it; run /user/login/start + /user/login/complete and retry inside the window. An open 2FA reset for this factor whose /complete call has already removed the old factor authorizes the call as well, and users without an SCA-gated (EUR/USDC) account yet are exempt.