fix(native-grants): fail loudly when native OTP/register hit a realm with grants disabled

[windischb]

The problem (real onboarding trap)

Entering an email and clicking login on a realm whose Native Passwordless Grants flag is off produced no email and no error. The OTP-request endpoint returned a silent uniform 200 ("If your email is registered…") and dispatched nothing — indistinguishable from "code sent", and impossible to diagnose unless you already knew the realm toggle existed. (Hit during AmZettel onboarding.)

Why it's safe to surface

Whether native grants are enabled is a realm/App configuration state, not a per-email signal — so an explicit error leaks nothing the anti-enumeration branch must protect. The native passkey-begin endpoint and the /connect/token grant already reject loudly when the flag is off; the OTP-request and native-register endpoints were the silent outliers. This aligns them.

Changes

Backend

• NativeOtpEndpoints — realm-grants-off → 400 NativeGrants.Disabled + a WARN log (lands in the per-realm error feed) instead of a silent 200. The email-existence branch below is untouched → anti-enumeration preserved.
• NativeRegisterEndpoints — split the realm-grants check out of the combined eligible flag: grants-off is now a loud 400; the posture gate stays a uniform no-op (a per-App routing choice, not a misconfiguration).

Frontend

• ClientDetails — warn when a client carries a native grant but the realm flag is off (the inverse of the existing "enabled" info note). Catches the misconfiguration at setup time, before the first login attempt. + German i18n.

Tests

• OTP-request realm-off now asserts 400 + NativeGrants.Disabled + no send.
• New native-register realm-off coverage.
• Rate-limit test asserts under-limit requests are not throttled (flag-independent).
• Full affected native set: 29/29 green.

Docs — native-apps.md Flow 1 note + errors-table row.

Defense-in-depth

Two complementary catches now make the silent failure nearly impossible: the frontend warning catches the admin at config time, and the backend error catches the consumer at the first login attempt.

🤖 Generated with Claude Code