Because:
- Passwordless Sync needs somewhere to store the envelope that lets a
passkey unlock kB without a password.
- A wrap is create-only: rotating kB invalidates it, so a stale one is
replaced by deleting the passkey and re-enrolling, never by an update.
This commit:
- Adds POST /passkey/wraps, one envelope per credential, behind a
verified session token and the passwordlessSyncEnabled flag.
- Pins each of the five envelope fields to its one legal v1 width,
checking decoded bytes rather than string length alone.
- Answers 201 on insert, 200 on an identical repeat, 409 on a different
one, and records wrap_created / wrap_creation_failure.
- Records both security events through a guarded helper, so an audit
write cannot 500 a committed wrap or mask the error that preceded it.
- Spreads caller additionalInfo first in recordSecurityEvent so it
cannot shadow server-derived audit fields.
Closes #FXA-13142