Returns the WebAuthn PublicKeyCredentialCreationOptions that the browser passes to navigator.credentials.create(), plus the application's allowedOrigins and relyingPartyId. Requires 'passkey' to be present in the application's allowedScaMethods. A subject may hold up to two passkeys; a third registration is rejected with 100004. — Requires an active SCA session granted within the last 15 minutes, else 30070 (SCA_REQUIRED) with reason NO_SESSION or EXPIRED, exactly as the SCA-gated reads report it; run /business/login/start + /business/login/complete and retry inside the window.