[leviFrosty]

Summary

• Moves device attestation (challenge, register, verify, status) under /attestation/v1/, shared by Notes Import and future protected routes. Handlers move from src/notesImport/ to src/attestation/.
• Adds the ATTESTATION_PURPOSES registry (src/attestation/purposes.ts). attestation-verify is verify's purpose, and notes-import-verify is still accepted there, so deployed apps keep working.
• Keeps POST /notes-import/challenge, /attest, and /verify on the same handlers, adding Deprecation and Link: rel="successor-version" headers and a deprecated path log line.
• Gives attestation routes their own per-IP rate-limit bucket. The old paths still count against notes-import.
• Serves the universal-link pages at readable paths: /contacts, /buddies/invite, and /accounts/handoff. The short /c, /b, and /h stay routed, and the AASA lists both. Each page's og:url is the path it was served on.
• Updates the AASA components, the Play Integrity and Notes Import docs, the OpenAPI docs for the attestation routes, and the verify-ww-api feature docs to match.

Testing

• Not run yet. Run these before merging:
  • pnpm test
  • pnpm exec tsc --noEmit
  • wrangler deploy --dry-run
  • wrangler deploy --env dev --dry-run
  • pnpm test:e2e src/e2e/public.e2e.test.ts -t "universal links"
  • pnpm test:e2e src/e2e/notesImport.e2e.test.ts
  • node scripts/verify/dev.mjs up, then doctor, then down
• Test files changed in this PR:
  • src/attestation/route.test.ts
  • src/notesImport/route.appAttest.test.ts
  • src/notesImport/route.playIntegrity.test.ts
  • src/accounts/handoffPage.test.ts
  • src/buddies/invitePage.test.ts
  • src/contactLink.test.ts
  • src/sentry.test.ts
• Also check that the old attestation paths return the same results as /attestation/v1/*, with the Deprecation and Link headers.
• Real-device App Attest and Play Integrity flows are not covered by the dev bypass and need a device test against the deployed dev worker.
• Rollout: the app has to parse the readable link paths for one release before it generates them. Old attestation paths stay until the minimum app version uses the new ones.