fix(fido): bound authenticator reset sweep

[savely-krasovsky]

What

How it was tested

• nix develop -c ./scripts/check.sh passes locally
• On hardware: board = …, what was exercised = …
• Host-only change (CLI / docs / CI) — no device behavior touched

Checklist

• Device behavior / image changed → config.device_release (bcdDevice) bumped by one (hex)
  in firmware/src/main.rs — host-only (CLI / docs / CI / build) does not (CONTRIBUTING.md)
• Fixes something a downgrade would reopen → flag whether the next release should advance the
  rollback epoch (docs/production.md, stage 3) — a seal-time --rollback call, not a code bump
• New or changed unsafe → justified in docs/unsafe.md
• User-visible behavior → the matching guide under docs/ updated
• New files carry the SPDX header (AGPL-3.0-only)
• Commit messages use the zone prefix style (fido:, piv:, rsk:, docs:, …)