Bind passkey enrollment to authenticated user

docs/DOGFOOD.md

@@ -34,3 +34,7 @@ application concern belongs in the shared module.
   explicit operator command.
 - Commerce remains a separately versioned nested module so payment-provider
   policy and catalog evolution do not enlarge the authentication core.
+- Self-service enrollment exposed an authorization seam: completing a valid
+  ceremony and checking its user only after persistence is too late.
+  `FinishRegistrationForUser` now consumes mismatched ceremonies and checks
+  the application-authenticated user before storing a credential.

docs/GETTING_STARTED.md

@@ -25,7 +25,7 @@ The packages are ordinary Go imports. Pin the current preview and verify its
 module checksum:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.10
+go get gamertan.com/web/requestmeta@v0.1.0-preview.11
 go mod verify
 ```
 

docs/MODULES.md

@@ -18,7 +18,7 @@ import "gamertan.com/web/requestmeta"
 and request the containing module at an exact version:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.10
+go get gamertan.com/web/requestmeta@v0.1.0-preview.11
 ```
 
 Only imported packages are compiled and linked. The packages nevertheless

docs/PASSKEYS.md

@@ -31,7 +31,9 @@ timestamp, UUID, or counter for the random challenge.
 2. A server-rendered enrollment page calls `BeginEnrollment`; the browser uses
    `navigator.credentials.create` with the returned `public_key` value.
 3. The browser posts the credential and opaque ceremony token to a bounded JSON
-   endpoint; `FinishRegistration` verifies and stores the public credential.
+   endpoint; authenticated self-service flows use
+   `FinishRegistrationForUser` so the application session's user ID is checked
+   before any public credential is stored.
 4. Login uses `BeginLogin`, `navigator.credentials.get`, and `FinishLogin`.
    The successful result contains an ordinary opaque `auth` session token.
 5. Sensitive operations call `BeginApproval` with a canonical application