Finish KEY-WP-0008: registration handoff and client MFA isolation

Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.

src/cmd/keycape/main.go

@@ -131,21 +131,33 @@ func main() {
 		TokenEndpoint:         issuer + "/token",
 		JWKSUri:               issuer + "/jwks",
 		UserinfoEndpoint:      issuer + "/userinfo",
+		EndSessionEndpoint:    issuer + "/logout",
 	}))
 
 	// JWKS.
 	mux.Handle("/jwks", oidc.NewJWKSHandler(ks))
 
 	// Authorize handler (with enforcement middleware).
+	logins := oidc.NewLoginSessionStore()
 	authorizeHandler := &oidc.AuthorizeHandler{
 		ClientConfig: clients,
 		Auth:         autheliaAdapter,
 		MFA:          privacyIDEAAdapter,
 		Sessions:     sessions,
+		Logins:       logins,
+		Handoffs:     oidc.NewHandoffStore(),
+		Issuer:       issuer,
 		Emitter:      emitter,
 	}
 	mux.Handle("/authorize", enforcement.Middleware(authorizeHandler))
 	mux.Handle("/authorize/callback", authorizeHandler)
+	mux.Handle("/authorize/return", authorizeHandler)
+	mux.Handle("/authorize/register", authorizeHandler)
+	mux.Handle("/logout", &oidc.LogoutHandler{
+		ClientConfig: clients,
+		Logins:       logins,
+		SecureCookie: strings.HasPrefix(strings.ToLower(issuer), "https://"),
+	})
 
 	// Token handler (with enforcement middleware).
 	tokenHandler := &oidc.TokenHandler{
@@ -272,8 +284,10 @@ func buildClientRegistry(cfgClients []config.ClientConfig) (map[string]*domain.C
 			ClientSecret:   clientSecret,
 			ServiceSubject: c.ServiceSubject,
 			Tenant:         c.Tenant,
-			Roles:          c.Roles,
-			MFARequired:    c.MFARequired,
+			Roles:           c.Roles,
+			MFARequired:     c.MFARequired,
+			RegistrationURL: c.RegistrationURL,
+			EnrollmentURL:   c.EnrollmentURL,
 		}
 	}
 	return m, nil