Issues the challenge for importing a hardware-bound key (Secure Enclave / Android Keystore) as a passkey. The app must bind this exact challenge into its attestation — Android setAttestationChallenge(challenge bytes) at key generation; iOS App Attest with clientDataHash = SHA-256(proof.clientData bytes), where the proof document embeds the challenge, the subject, the credential id and the public key hash — and into the proof it signs for /passkey/import/complete. Requires 'passkey' in the application's allowedScaMethods and a deviceAttestation configuration for the platform (else 100010). The two-passkey cap applies (100004). The challenge lives 10 minutes and is single use. — Requires an active SCA session granted within the last 15 minutes, else 30070 (SCA_REQUIRED) with reason NO_SESSION or EXPIRED, exactly as the SCA-gated reads report it; run /user/login/start + /user/login/complete and retry inside the window. After a 2FA reset the user logs in with SMS first, then imports the new key inside the window. The login endpoints are open as soon as the mobile number is verified, so enrolment during onboarding is: verify mobile, /user/login/start + /user/login/complete, then this call within 15 minutes.