Implement WebAuthn passkey registration ceremony on the web

Steps

1. On the server, generate a registration options object containing a random cryptographic challenge (at least 16 bytes), the relying party (rp) name and id, the user id and display name, and the pubKeyCredParams list specifying supported algorithms (e.g., ES256, RS256).
2. Serialize the options and send them to the browser; call navigator.credentials.create({ publicKey: options }) after decoding the challenge and user id from base64url.
3. The browser prompts the user to create a passkey using a platform authenticator or roaming key; on success, the API returns a PublicKeyCredential containing the attestation object and client data JSON.
4. Send the credential response to the server; verify the client data JSON (check type is 'webauthn.create', origin matches your domain, and challenge matches), then parse and validate the attestation object.
5. Extract the public key and credential ID from the authenticator data inside the attestation object; store both securely associated with the user's account.
6. Respond with success to the client; the passkey is now registered and can be used for future authentication ceremonies.