feat: send content-signing public key during device registration

[felippemsc]

Summary

• Add required publicKey field to DeviceCreateRequest (maps to public_key in JSON)
• Inject SecureEnclaveService into SignedShotClient and call getPublicKeyBase64() during registration
• Share the same SecureEnclaveService instance between client and MediaIntegrityService in the example app

Context

The API now requires public_key at device registration to enable cross-layer binding.
The server computes SHA-256(base64_decode(public_key)) and includes the fingerprint in the JWT.

The public key format is the same one already used in the sidecar's media_integrity.public_key: Base64 of the 65-byte uncompressed EC point (0x04 + X + Y) from the Secure Enclave.

Test plan

• APIModelsTests updated for publicKey encoding/decoding
• Build and run on device — verify registration succeeds with the new field
• Decode the JWT from a capture flow and confirm device_public_key_fingerprint is presen
• Verify SHA-256(base64_decode(sidecar.media_integrity.public_key)) matches the JWT claim