Implement WebAuthn passkey authentication ceremony on the web

Steps

1. On the server, generate an authentication options object containing a fresh random challenge, the relying party id, and optionally an allowCredentials list containing the credential IDs registered to the user.
2. Send the options to the browser; call navigator.credentials.get({ publicKey: options }) after decoding the challenge; the browser locates a matching passkey and prompts the user for biometric or PIN confirmation.
3. On success, the API returns an AuthenticatorAssertionResponse containing the authenticator data, client data JSON, and a cryptographic signature.
4. Send the assertion to the server; verify the client data JSON (type is 'webauthn.get', origin and challenge match), then verify the signature over the authenticator data and client data hash using the stored public key for this credential.
5. Check the authenticator data flags: confirm the user presence (UP) bit is set and, if your policy requires it, the user verification (UV) bit is also set.
6. Update the stored sign count for the credential (raise an error if the returned count is not greater than the stored count, as this may indicate credential cloning); complete the user's session.