Passkey Registration and Sign-In Outline

Outline passkey registration and sign-in for our app. Use the platform APIs and a well-known server library. This is an implementation plan, not a novel protocol. APP Users already have: [PASSWORD | MAGIC LINK | NOTHING] Library preference: [SIMPLEWEB AUTH | OTHER | UNSURE] Where credentials are stored: [DATABASE] DELIVER 1) The registration ceremony in steps: logged-in user, server challenge, browser create, server verifies and stores credential id and public key. What we store and what we never store (the private key). 2) The sign-in ceremony: identifier if needed, challenge, browser get, verify signature and counter. 3) The recovery story: a passkey is not a password reset. What the backup factor is, because I must name one: [EMAIL LINK | ANOTHER PASSKEY | SUPPORT]. If I left it blank, stop and make me choose before writing the happy path only. 4) UX copy points: what the system dialog will say, and the screen we show when the device has no platform authenticator. 5) Threats this does not remove: a phished session after login, a stolen logged-in device. One sentence each. Do not invent a custom crypto scheme. Do not ask the user to type the private key.