Enrolls a new device key from a hardware-backed platform attestation. Provide exactly one of certificate_chain_android or attestation_ios. The attestation must embed the enrollment challenge, computed as follows: 1. Base64-decode the settings flow's hidden deviceauthn_nonce UI node value, parse the result as JSON, and base64-decode its nonce field. 2. For a key without a PIN, the raw nonce bytes are the challenge. For a PIN-protected key, the challenge is the SHA-256 of the raw nonce concatenated with the raw transport_public_key bytes, which binds the transport key into the attestation. For a PIN-protected key the server returns a one-time sealed pin_secret in the flow's continue_with items (action show_pin_entry_ui).