Issues the challenge for importing a hardware-bound key (Secure Enclave / Android Keystore) as a passkey. The app must bind this exact challenge into its attestation — iOS App Attest with clientDataHash = SHA-256(challenge bytes), Android setAttestationChallenge(challenge bytes) — and into the proof it signs for /passkey/import/complete. Requires 'passkey' in the application's allowedScaMethods and a deviceAttestation configuration for the platform (else 100010). The five-passkey cap applies (100004). The challenge lives 10 minutes and is single use.