No authenticator policy: synced passkeys cannot be blocked and AAGUIDs cannot be restricted

[Bccorb]

Part of #155. Session 5. Depends on #165 (AAGUID) and #168 (metadata).

Problem

The public sector README records the design position on synced passkeys as "blocked
by default, agency may enable", and asks that this be confirmed against actual
behaviour.

Confirmed: it is not implemented. The credentials table stores backedup
(src/models/credentials.ts:19), which is the
WebAuthn backup state flag, but nothing ever reads it to make a decision. There is
no AAGUID column, so there is no authenticator allow-list either. Any synced
consumer passkey enrolls successfully.

Why it matters

Two commitments depend on this:

• The stated synced passkey position. Until this ships, the website text is
  describing behaviour that does not exist and should be corrected in the interim
• Agencies that want to restrict enrollment to FIPS-validated authenticators express
  that policy by AAGUID, and cannot today

What to do

Add an authenticator policy block to system_config covering:

• Attachment (see Passkey registration is locked to platform authenticators, so security keys cannot be enrolled #156)
• Synced passkey posture, reading the backup eligibility and backup state flags
• AAGUID allow-list and deny-list
• Whether to require an attestation the metadata service recognises

Enforce it at registration, with a clear error the SDK can render.

Acceptance

• A synced passkey is refused when the policy blocks it, with a distinguishable error
• An AAGUID allow-list admits only listed authenticators
• Policy is per deployment and readable from system_config
• The website text and the README design position match actual behaviour

Freeze status

Exception 4, and it is the resolution of an open decision the README explicitly
flags.

Ripple

Contract-affecting. @seamless-auth/types needs the policy schema, and
seamless-auth-react needs to render the new refusal reasons.