Persist user CAPIF session from /getauth

Keeps the CAPIF access_token returned by register's /getauth in the backoffice JWT, so onboarding can authenticate as the user. Static ccf_* endpoint paths move to env config, with a warning logged on login if they drift from what CAPIF returns.