feat: operator trust root: passkey-signed operator set, signed join codes, nodes verify and pin the chain at enrollment [CI SKIP]

backend/src/MoShiro.Backend.Api/Common/EndpointConventions.cs

@@ -18,6 +18,11 @@ public static class EndpointConventions
             return Task.CompletedTask;
         });
 
+    /// <summary>
+    /// 这个端点自己要求 passkey 签名（请求里带着断言），比提权窗口更强，所以不再要求窗口：守卫跳过信任类能力的提权检查。
+    /// </summary>
+    public static RouteHandlerBuilder ElevationExempt(this RouteHandlerBuilder builder) => builder.WithMetadata(new ElevationExemptMarker());
+
     /// <summary>匿名可访问的管理端点（登录）：显式声明，对账测试才能区分「忘了声明」。</summary>
     public static RouteHandlerBuilder AllowsAnonymous(this RouteHandlerBuilder builder) =>
         builder.WithMetadata(new CapabilityRequirement(null));