Submits the WebAuthn PublicKeyCredential returned by the browser to bind the passkey to the application. Returns the credential details and the refreshed MFA state. Same gates as /corporate/passkey/register/start except the dashboard login: Requires SCA to be enabled for the application (else 400 30074 SCA_NOT_ENABLED) and passkey in its allowedScaMethods (else 400 31099). The application must have its webAuthn block (relying party id and allowed origins) configured, else 999998 (Passkeys not enabled for application). An application holds at most one API passkey: a second enrolment is rejected with 100004. Portal admins keep their own passkeys, one each.