[SPIKE] Expose signing functions

Add two new public methods to the `User` operations:
- `device_sign_data`
- `device_verify_data`

`device_sign_data` takes a borrowed reference to an array of bytes to sign. It should append a byte string containing the current device public signing key (base64 encoded), the current date-time (RFC3339 format), and the provided user ID, then use the current device's private signing key to generate the ed25519 signature (as a base64 encoded string) and return the byte string with the signing key date-time, provided user id, and signature.

`device_verify_data` takes borrowed reference to an array of bytes to verify and another borrowed reference to a string containing the public signing key, date-time, and provided user id, followed by the signature. It should extract the public key, pull off the signature, and validate the signature using the public key. Return boolean

Start by locating the User operations and the existing device signing-key and Ed25519 APIs. Confirm the specified byte-string layout, RFC3339 timestamp, base64 encoding, user ID handling, and verification result, then add coverage for device_sign_data and device_verify_data.

Written by the indexing model from the issue text.