Connect to a location with a posture check assigned without MFA

[kchudy]

Description

• Implement a flow for connecting to a location with posture checks assigned
• Use the following flow:

1. Client → Edge: sends posture signals
2. Edge → Core: evaluates posture
3. Core → Edge: returns decision + signed token (includes device, user, location, expiry, posture_pass=true)
4. Client → Gateway: presents token when initiating VPN
5. Gateway verifies token

• Display failure reasons if checks failed
• Displaying postrue check errors is out of scope, separate task Render posture check errors #859