Confirm a newly issued device after POST /auth/login (or /auth/login/challenge) returns newDeviceMetadata. The browser generates the SRP verifier; this endpoint registers the device and sets remembered status so the client never calls cognito-idp.