Add the FIDO2 conformance test interface behind an environment flag

[Bccorb]

Part of #155. Session 6. Depends on Sessions 4 and 5.

Problem

The FIDO2 conformance test tools drive a server through a standard message
interface so that requests and responses can be validated against the
specification. This API exposes no such surface, so conformance self-validation
cannot be run at all.

Why it matters

Conformance self-validation is the first gate of FIDO Functional Certification, and
it is the step that can be done today without an assessor, without a customer and
without a sponsoring agency. Everything else in the FIDO track is blocked on it.

What to do

• Add the conformance route group behind an environment flag, defaulting to off
• Ensure it is unreachable in any production deployment, and add a test that fails
  if it is mounted when the flag is unset
• Wire the local metadata statements that the conformance tools provide
• Document how to run the tools locally

Acceptance

• The conformance interface is reachable only with the flag set
• A production build with the flag unset serves 404 on those paths
• The tools can complete a run against a local instance

Freeze status

FIDO conformance self-validation (exception 3).

Security note

This surface bypasses normal flows by design. It must never be enabled in a
customer deployment, and that should be enforced rather than documented.