derivePrfEntropy

Authenticate the user's passkey with the seed-derivation salt and return the raw 32-byte PRF output. The output is BIP-39 entropy size — callers can pass it directly to BIP39.entropyToMnemonic.

Throws BackupException when the authenticator doesn't support the PRF extension (rare on Android — Google Password Manager supports it by default).