AUTH4D-344 Passkey sign-up limits

No request or response shapes change. Passkey sign-up (registration without a proof, in an authorization, device sign-in or guest-linking flow; see AUTH4D-143 (repository file docs/api-spec/auth4d-143.md) and AUTH4D-214 (repository file docs/api-spec/auth4d-214.md)) now has its own limits on top of the 20 ceremonies per browser flow. Enrolling a passkey on an existing account is not affected.

• The client IP is the one every per-IP limit uses (AUTH4D-335 (repository file docs/api-spec/auth4d-335.md)): IPv4 as is, IPv6 grouped by /64. It is stored only as a keyed hash.
• registration/verify spends the client IP’s budget before the project’s, so one limited address does not use up the project ceiling. Both are spent after the WebAuthn checks pass and before the pre-registration hook and the account insert.
• An exhausted budget returns 429 slow_down.
• A second sign-up in the same browser flow returns 403 access_denied, including one that uses options issued before the first account was created. The flow’s sign-up is used up once the account creation starts, even if it then fails.
• When the client IP is unknown (or the deployment has no privacy key), both sign-up endpoints return 503 temporarily_unavailable and nothing is created.