feat(jans-fido2): generate & export assetlinks.json and apple-app-site-association from RP config

**Is your feature request related to a problem? Please describe.**
Native passkeys require two association files hosted on the RP-ID domain's `/.well-known/` path: Android `assetlinks.json` (declaring `delegate_permission/common.get_login_creds`, package name, and SHA-256 signing fingerprints) and iOS `apple-app-site-association` (AASA, declaring the `webcredentials` service with `TeamID.BundleID` app IDs). Admins hand-author these today, and the single most common deployment failure is a **mismatched fingerprint or Team ID** between the deployed file and the server's expectation. There is no generation support in jans-fido2 (confirmed: no `assetlinks`/`apple-app-site-association`/`.well-known` handling anywhere in the tree).

**Describe the solution you'd like**
From the structured RP origin/RP-ID config (single source of truth — the mobile origin/RP-ID policy model), generate both files and let the admin **download** them for deployment on the RP-ID domain:

- `assetlinks.json`: emit `relation: ["delegate_permission/common.get_login_creds"]` with `target.namespace=android_app`, `package_name`, and `sha256_cert_fingerprints[]` for each configured Android app.
- `apple-app-site-association`: emit the `webcredentials.apps` array as `TeamID.BundleID` for each configured iOS app; served (when applicable) as `application/json` with **no** `.json` extension.
- **Start with download-and-deploy.** A future enhancement can *optionally* serve these files directly **only when Jans is deployed on the RP-ID host** — with the important caveat that both Apple and Android fetch from `/.well-known/` and **follow no redirects**, so serving only works when Jans *is* the RP-ID host (e.g. RP-ID `example.com` served from `login.example.com` will not work; the admin must deploy on `example.com`).
- Expose generation via the Config API fido2 plugin (`jans-config-api/plugins/fido2-plugin`) so the Admin UI can add a "Generate / Download" action.

**Describe alternatives you've considered**
- *Always serve the files from Jans* — rejected as the default: only valid when Jans is the RP-ID host; download-and-deploy works universally.
- *Documentation-only (hand-authoring guide)* — insufficient; the mismatch errors this is meant to eliminate come precisely from hand-authoring.

**Additional context**
Pairs with the readiness checker (validates the deployed file matches generated content). Attach the export design mockups (Android + iOS generator screens).
Corbado article — https://www.corbado.com/blog/native-ios-android-passkey-implementation-challenges ;
ChatGPT analysis — https://chatgpt.com/share/6a5129bc-a8f4-83ea-8649-3e463e0a7db3