Portable v2 request PoP. Hosts supply the effective key from an already verified Biscuit and separately enforce account attachment, scope, current revocation and durable nonce consumption. This check grants no authority.