Do some fancy stuff because we can 👀
When no knot is explicitly configured, select the sole registration whose ownership endpoint confirms the authenticated user's DID. Fall back to the hosted knot only when no registrations exist, and reject unverifiable or ambiguous registrations so we don't silently create on the wrong server.