Register Notification Device Token

Required on non-GET requests to non-public paths (DeviceSignatureFilter), skipped for GET/whitelisted/multipart requests and in the local profile.

Base64 ECDSA signature over sha256(body) + timestamp + requestId, signed with the device's registered private key.

Unix epoch seconds; must be within 5 minutes of server time.

Unique per request - reused values are rejected as replays.