Use cert's Subject.CommonName (the phone number) to find identity instead of extracting pubkey and iterating DB. Each cert is bound to a number; the cert tells us which number directly. Also verify cert pubkey matches stored identity pubkey.
Allocate now checks if pubkey already has an identity and returns it. Prevents duplicate identities for same pubkey (was causing random number assignment on cert auth). GetByPubKey returns identity with highest CreatedAt for deterministic behavior.
New flow: connect -> OpGetChallenge -> OpAuthCert (signature + certDER) -> server verifies cert chain + Ed25519 signature over challenge data -> reuses existing identity. No re-registration on reconnect.
