refactor(signup): drive Fayda through register-with-fayda

Follows the API back to a single endpoint. The page posts { action: 'start' }
to open the attempt, the callback page posts { action: 'verify', ... } to get
the verified identity, and the existing signup submission is unchanged.

Drops the post-signup link call: there is no longer a link endpoint, and the
account is created by the signup endpoint that already owns user creation.

libs/auth/src/lib/utils/fayda-session.ts

@@ -3,9 +3,9 @@
  * survive it lives in sessionStorage: same tab, same origin, gone when the tab
  * closes.
  *
- * Nothing secret is kept here. `transactionToken` and `verificationToken` are
- * signed by the API and are useless without it — the PKCE verifier and the
- * client secret never leave the backend.
+ * Nothing secret is kept here. The `transactionToken` is signed by the API and
+ * useless without it — the PKCE verifier, the nonce and the client key never
+ * leave the backend.
  */
 
 const REQUEST_KEY = 'fayda:request';
@@ -26,16 +26,14 @@ export interface FaydaPrefill {
   address?: string;
 }
 
+/** Shape of `POST /auth/register-with-fayda` with `action: "verify"`. */
 export interface FaydaResult {
-  prefill: FaydaPrefill;
-  /** Always true when the API returned a result at all. */
+  identity: FaydaPrefill;
   faydaVerified: boolean;
   /** Signup fields Fayda vouched for. */
   verifiedFields: string[];
   /** Prefilled fields already taken by another account. */
   conflicts: string[];
-  /** Posted to /auth/fayda/link once the account exists. */
-  verificationToken: string;
 }
 
 // Private browsing and locked-down browsers can throw on access, and a failure