games.cavu.bindSession

Served by the game host named in a grant's hostService. The game server presents the grant and its attestation with a DPoP proof (DPoP header, ES256). The host verifies the attestation against the launch service's key, checks the grant is unexpired and names this host, checks `jkt` matches the proof key, consumes the nonce (which it minted for `player`), and binds a session to that key. Later calls (getCapabilities, com.atproto.repo.putRecord, ...) carry `Authorization: DPoP <session>` plus a fresh proof.