Complete authentication and create handoff token

Completes the authentication attempt and mints a `handoff_token`. Call this after all required factors have been verified and the attempt is in `completed` state. The handoff token is short-lived (≤60 seconds) and must be exchanged at POST /sessions/exchange to receive the final session and session_token. The handoff token is: - Single-use (atomic exchange, no retry) - Audience-bound (requires matching project key for exchange) - Idempotency-safe within a 5-minute window (see conventions)

curl -X POST "https://example.com/auth_attempts/abc123def456/handoff"

{  "handoff_token": "handoff_abc123def456xyz",  "expires_at": "2026-04-28T15:31:00Z"}

{  "code": "att.not_found",  "message": "The auth attempt was not found."}