Finish KEY-WP-0008: registration handoff and client MFA isolation

Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.

src/internal/config/validate.go

@@ -63,6 +63,16 @@ func ValidateConfig(cfg *Config) []string {
 				errs = append(errs, prefix+fmt.Sprintf(": redirect_uri %q must not contain wildcards", uri))
 			}
 		}
+		if c.RegistrationURL != "" {
+			if err := validateHandoffURL(c.RegistrationURL); err != nil {
+				errs = append(errs, prefix+": registrationUrl: "+err.Error())
+			}
+		}
+		if c.EnrollmentURL != "" {
+			if err := validateHandoffURL(c.EnrollmentURL); err != nil {
+				errs = append(errs, prefix+": enrollmentUrl: "+err.Error())
+			}
+		}
 	}
 
 	// Private key PEM path must be provided (existence is checked at startup).
@@ -81,3 +91,20 @@ func contains(values []string, wanted string) bool {
 	}
 	return false
 }
+
+func validateHandoffURL(raw string) error {
+	u, err := url.Parse(raw)
+	if err != nil || u.Scheme == "" || u.Host == "" {
+		return fmt.Errorf("%q is not an absolute URL", raw)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return fmt.Errorf("%q scheme must be http or https", raw)
+	}
+	if u.User != nil {
+		return fmt.Errorf("%q must not contain userinfo", raw)
+	}
+	if strings.ContainsAny(u.Host, "*?") || strings.ContainsAny(u.Path, "*") {
+		return fmt.Errorf("%q must not contain wildcards", raw)
+	}
+	return nil
+}