Carry the controller vouch when linking a generation to a site

[lemarier]

Linking a controller generation to a site (origin89hq/cloud#3) will require the controller's vouch (origin89hq/km43#135, Vouch 0x14/0x94). The app is the only party that can carry it: the cloud cannot reach the controller.

Expected:

• ask the cloud for a verifier key, nonce and account binding over the signed-in session;
• send Vouch 0x14 on the session; every controller speaking this version answers it, with no capability bit to check first (feat: retire the Vouch capability bit km43#139);
• hand the cloud the Vouch 0x94 answer with the controller key the app pinned (P-222), never a key from Discover;
• on bad_verifier, or a refusal from the cloud, show that the link failed and offer a retry with a fresh nonce.

Next step: add the request and answer to the KM43 client once the km43 release carrying them is published, with SetupKit tests for a vouched link and bad_verifier.

Contract: origin89hq/km43#135