Brings in upstream v0.7.1, including the webpki-roots / webpki-root-certs 1.0.10 and rustls-webpki 0.103.16 bump for the eMudhra intermediate compromise. Version stays at upstream's 0.7.1. Conflicts: - authorize/login.rs: upstream wraps authorize_get responses in respond!() (iOS cookie test); the fork's ?sso= forwarding (register and login redirects) now goes through respond!() too. authorize_post takes upstream's begin_second_factor flow; the device cookie it uses is read with the fork's current_device() (bumps last_seen, drops swept devices). - authorize/mod.rs: AuthorizeQuery keeps both the fork's `sso` and upstream's `redirect_test` fields. - authorize/passkey.rs, two_factor.rs: upstream's begin/complete_second_factor and consent_or_code structure, with every extract_device_cookie() call replaced by current_device() as the fork's device-retention commit did. - tests/it/store_parity.rs: union of imports (fork DeviceId, upstream OutboundMessage). - tranquil-store metastore/oauth_ops.rs: fork device-link helpers and stage_account_devices_removal kept; one test module with both the fork's stale-device sweep test and upstream's completed-identity guard test (chrono::Duration imported in the test module since upstream dropped it from the top-level import). - frontend api.ts: createPasskeyAccount takes upstream's requestUri and the fork's captchaToken. - frontend registration/flow.svelte.ts: fork's single sign-up form kept; upstream's registration binding applied by sending requestUri from the URL in createAccount (upstream's did:web/BYOD code stays removed). - frontend Register.svelte: upstream's login_required -> goToLogin handling added (goToLogin ported) alongside the fork's signup.errors.generic text. - frontend tests/oauth-registration.test.ts (auto-merged, adapted): the new request_uri test now drives the fork's createAccount(); the passkey variant is dropped as the fork's flow has no passkey-account creation. Squashed from the merge 7aaa931 (parents 7a4c109, v0.7.1 4e5ded7) so the PR applies as a patch on tangled; the tree is identical to that merge.