Correct the OTP request contract for authenticated WebView entry

[Aalv3]

Why

PR #19's device validation failed at step A. The request ledger showed, twice:

settled  PUT:/notifications/read        success
started  POST:/user-api-key/otp
settled  POST:/user-api-key/otp         failure  4xx   (~140ms)

Root cause, from app/controllers/user_api_keys_controller.rb:

def require_params_otp
  %i[public_key auth_redirect application_name].each { |p| params.require(p) }
end

application_name is required and was omitted, so the request was rejected as ActionController::ParameterMissing before any OTP was minted.

A second contract issue was found in the same read: create_otp uses respond_to with both an HTML and a JSON branch, and site.jsonApi sends no Accept header. Without an explicit .json, the server takes format.html and answers 302 to the custom scheme, which fetch cannot follow.

Changes

js/webViewSession.js

• OTP_ENDPOINT is /user-api-key/otp.json
• The request body is public_key, auth_redirect, application_name, padding — application_name reuses siteManager.deviceName, the same identity the authorization flow registers
• WEB_SESSION_STAGES + webSessionFailure(stage, cause) classify each failure point

js/Discourse.js, js/screens/WebViewScreenComponents/WebViewComponent.js

• A bootstrap failure records {event, stage, outcome, category} through the existing profileDiagnostics allowlist, readable on device via yarn device:harness profile-diagnostics. destination_resume records the terminal success stage.

The dialog itself was working as designed; it was simply the only observable, which is why a 400 and a decrypt failure were indistinguishable on device.

Unchanged

RSA machinery (no second cryptographic implementation), User-Api-Key / User-Api-Client-Id headers, rate-limit buckets and cooldowns, the /session/otp/ confirmation form, the canonical-origin destination boundary, the bootstrap-scoped WebView navigation window, and the /renaissance/member-photo/ credential boundary. No new bridge endpoint. No runtime version change. JS-only.

Diagnostics contain no secrets

Only a fixed stage label and a coarse status class (429 / 4xx / 5xx / timeout / network_or_unknown). A test asserts that no failure carries the User API key, either RSA key, the encrypted blob, the OTP, the client id, or a URL.

Gates

• format:check clean, lint clean
• Jest 787/787 across 96 suites (32 in webViewSession.test.js)
• verify:ota, verify:ios-auth, verify:release-readiness, validate:ota all PASS
• Native Release build via CI on this PR

Also fixes a real-clock race in rateLimitResilience.test.js: Date.now() was evaluated twice in one assertion and could straddle a millisecond. It failed once in a full-suite run and passed in isolation.

Not done here

No OTA published. Basic is untouched and preserved as the second device fixture.

[Aalv3]

Superseded by #22. The OTP request contract in this PR was correct - the request succeeded on device and the confirmation form rendered - but Finish Login failed with "Missing, invalid or expired token", and the founder has since ruled the architecture wrong regardless: a member already authenticated in the native app must not perform a second web authentication to read a notification. Notification taps now resolve to native intents. History preserved in testing/native-auth-stale-identity/BACKLOG.md item 9; the OTA provenance tag ota-eb509d26-43af7b78 remains immutable.