Finish KEY-WP-0008: registration handoff and client MFA isolation

Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.

src/tests/profile/profile_test.go

@@ -64,6 +64,10 @@ func (m *mockMFA) CheckMFARequired(_ context.Context, _ string) (bool, error) {
 	return m.required, m.checkErr
 }
 
+func (m *mockMFA) HasEnrolledFactor(_ context.Context, _ string) (bool, error) {
+	return m.required, m.checkErr
+}
+
 func (m *mockMFA) ValidateMFAToken(_ context.Context, _, _ string) error {
 	return m.mfaErr
 }