Finish KEY-WP-0008: registration handoff and client MFA isolation

Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.

src/internal/config/config_test.go

@@ -127,6 +127,50 @@ clients:
 	}
 }
 
+func TestLoad_ClientMFAAndRegistrationURL(t *testing.T) {
+	keyPath := writeTempFile(t, "placeholder-key")
+	yaml := `
+issuer: "https://kc.example.com"
+port: 8080
+tokenLifetime: "15m"
+privateKeyPem: "` + keyPath + `"
+environment: "dev"
+clients:
+  - clientId: "coulomb-social"
+    displayName: "coulomb.social"
+    redirectUris:
+      - "https://coulomb.social/auth/callback/"
+    clientType: "public"
+    mfaRequired: false
+    registrationUrl: "https://users.example.com/register"
+`
+	cfgPath := writeTempFile(t, yaml)
+	cfg, err := config.Load(cfgPath)
+	if err != nil {
+		t.Fatalf("Load: unexpected error: %v", err)
+	}
+	if len(cfg.Clients) != 1 {
+		t.Fatalf("clients: got %d", len(cfg.Clients))
+	}
+	c := cfg.Clients[0]
+	if c.MFARequired == nil || *c.MFARequired {
+		t.Fatalf("mfaRequired: want false, got %+v", c.MFARequired)
+	}
+	if c.RegistrationURL != "https://users.example.com/register" {
+		t.Errorf("registrationUrl: got %q", c.RegistrationURL)
+	}
+}
+
+func TestValidate_InvalidRegistrationURL(t *testing.T) {
+	keyPath := writeTempFile(t, "key")
+	cfg := validConfig(keyPath)
+	cfg.Clients[0].RegistrationURL = "javascript:alert(1)"
+	errs := config.ValidateConfig(cfg)
+	if !containsErr(errs, "registrationUrl") {
+		t.Errorf("expected registrationUrl error, got %v", errs)
+	}
+}
+
 func TestLoad_PrivacyIDEARequireForAll(t *testing.T) {
 	keyPath := writeTempFile(t, "placeholder-key")
 	yaml := `