public interface IAttestationService
{
    /// <summary>
    /// Validates that the user is a credentialed clinician and that the
    /// password re-confirm matches their stored hash. Throws on failure.
    /// </summary>
    /// <param name="userId">The authenticated user's ID from JWT claims.</param>
    /// <param name="clinicianAttestation">Must be true; false throws ValidationException.</param>
    /// <param name="passwordConfirm">Raw password for re-confirmation.</param>
    /// <returns>The validated User entity.</returns>
    Task<User> ValidateAttestationAsync(Guid userId, bool clinicianAttestation, string passwordConfirm);
}