Two changes needed to drive the Phase-1 end-to-end smoke test without a
browser and Pocket-ID:
- Add `-dev-auth-sub` / `APPROVAL_DEV_AUTH_SUB` so a dev / CI run can
stamp every request with a fixed principal sub instead of refusing
all callers until Pocket-ID is wired. Mutually exclusive with any
real auth middleware; the deployment path still fails closed.
- Add `-dev-routes` / `APPROVAL_DEV_ROUTES` which mounts
`POST /dev/webauthn/credentials` on the Phase-1 in-memory WebAuthn
store. The smoke test generates an Ed25519 keypair and posts the
public half here before confirming the approval. Both flags log a
WARN at startup so a misconfigured prod stands out.
Separately, promote four chain-control fields —
`allowed_transformations`, `allowed_sinks`, `expires_at`,
`workflow_id` — from the signed rendered content into the approval
predicate. The verification-service already requires these on the
approval predicate to enforce the sink / transform allowlists and the
approval TTL; they live inside H_content so promoting them does not
weaken the WebAuthn-bound signature.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
