Issues the challenge for importing a hardware-bound key (Secure Enclave / Android Keystore) as a passkey. The app must bind this exact challenge into its attestation — Android setAttestationChallenge(challenge bytes) at key generation; iOS App Attest with clientDataHash = SHA-256(proof.clientData bytes), where the proof document embeds the challenge, the subject, the credential id and the public key hash — and into the proof it signs for /passkey/import/complete. Requires 'passkey' in the application's allowedScaMethods and a deviceAttestation configuration for the platform (else 100010). The two-passkey cap applies (100004). The challenge lives 10 minutes and is single use. — Requires an active SCA session granted within the last 15 minutes, else 30070 (SCA_REQUIRED) with reason NO_SESSION or EXPIRED, exactly as the SCA-gated reads report it; run /business/login/start + /business/login/complete and retry inside the window. After a 2FA reset the user logs in with SMS first, then imports the new key inside the window.