Passkey-first registration
What happens
Create identity
Your account is persisted in PostgreSQL.
Register passkey
WebAuthn stores the credential public key and counter after server verification.
Start session
A server-side session is created only after the passkey ceremony succeeds.
