Add iOS App Attest verifier and refresh endpoints

[aliXsed]

Summary

• Local Apple App Attest verification (CBOR attestation object, X.509 chain to the bundled Apple root, nonce OID / keyId / rpIdHash / counter / AAGUID) with clock-injected cert validity for fixtures and production.
• POST /v1/attest/ios for initial attestation and POST /v1/attest/refresh for generateAssertion re-proof, including atomic iOS counter CAS (memory + Redis Lua) and lost-response idempotency within the challenge TTL.
• Conformance coverage against Apple's current documentation fixture (tests/fixtures/apple_app_attest/), plus integration tests for the wallet-authenticated routes.

Builds on the merged claims/plumbing work from #20.

Test plan

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --check
• Confirm Apple fixture conformance tests pass (IosAttestationVerifier unit tests)
• Confirm /v1/attest/ios upgrades a wallet session to attested tier and returns a fresh access token
• Confirm /v1/attest/refresh rejects non-increasing counters and accepts a valid assertion replay only as an idempotent lost-response case
• Confirm Redis store path exercises the Lua CAS for put_ios_assertion_record

Made with Cursor

[github-actions]

Coverage report

Thresholds: 80% line · 78% region (condition)

✅ Coverage meets the required threshold.

   13|      1|            .init(),
   14|      3|        _ => registry.with(tracing_subscriber::fmt::layer()).init(),
   15|       |    }
   16|      4|}