User and Device Registration

Endpoints for registering users and linking their device's Secure Enclave key to their account. Device registration uses a challenge-response flow to prove key possession, plus a successful face match session when the user already has a face enrolled.

Deployments that run policy-svc register users through the register-with-policy variant, which also creates the user on the policy service.

Method	Endpoint	Description
POST	/auth/users/register	Register a new user from their JWT identity
POST	/auth/users/register-with-policy	Same, plus registering the user on policy-svc
GET	/auth/devices/challenge/:device_verifying_key	Get a short-lived challenge for device key proof
POST	/auth/devices/register	Register a device's public key; requires a face_session_id if the user has a face enrolled
POST	/v2/auth/devices/register-and-recover	Register a device and recover its keyshares with one face scan