New flow: register -> OpRegister(pubKey) -> OpIdentity(number+cert). Reconnect: OpGetChallenge -> OpAuthCert(cert+sig). PoW eliminated from client flow.
New flow: connect -> OpGetChallenge -> OpAuthCert (signature + certDER) -> server verifies cert chain + Ed25519 signature over challenge data -> reuses existing identity. No re-registration on reconnect.