Returns the WebAuthn PublicKeyCredentialCreationOptions that the browser passes to navigator.credentials.create() to enrol the application's API passkey, plus the application's allowedOrigins and relyingPartyId. The request carries no userId/applicationId: the subject is the application that signed the request. Requires SCA to be enabled for the application (else 400 30074 SCA_NOT_ENABLED) and passkey in its allowedScaMethods (else 400 31099). The application must have its webAuthn block (relying party id and allowed origins) configured, else 999998 (Passkeys not enabled for application). An application holds at most one API passkey: a second enrolment is rejected with 100004. Portal admins keep their own passkeys, one each. Also requires the application's root admin (not a sub-admin) to have logged in to the Striga dashboard with their passkey or SMS within the last 15 minutes, else 403 30070 with reason NO_SESSION or EXPIRED (SCA_REQUIRED - Please login to the dashboard), or ROOT_ADMIN_REQUIRED when the latest dashboard login was a sub-admin's (SCA_REQUIRED - The application root admin must login to the dashboard).