feat(dpop): provide nonce on immediate login

provide the DPoP nonce via cookie on login, this reduce the amount of API call
and prevent having any first call returning in 401

src/interfaces/api/handlers/opaque_auth_handler.rs

@@ -829,6 +829,14 @@ pub async fn login_ke3(
         state.core.config.auth.refresh_token_expiry_secs,
     );
     cookie_auth::append_csrf_cookie(response.headers_mut(), session.expires_in);
+    // Seed the SPA's DPoP-nonce cache so the first bound request after
+    // login doesn't eat a `use_dpop_nonce` challenge → retry cycle.
+    // No-op when `dpop_mode = off`.
+    cookie_auth::maybe_append_dpop_nonce_cookie(
+        response.headers_mut(),
+        &state.dpop_nonce_service,
+        state.core.config.auth.dpop_mode,
+    );
     Ok(response)
 }