12. Kebutuhan Server-side

POST /auth/passkey/register/begin
  Request: { username }
  Response: {
    challenge: string (base64url),
    userID: string,
    displayName: string,
    rpID: string,
    rpName: string
  }

POST /auth/passkey/register/finish
  Request: {
    credentialID: string (base64url),
    clientDataJSON: string (base64url),
    attestationObject: string (base64url)
  }
  Response: { success: bool }

POST /auth/passkey/auth/begin
  Request: {} atau { username } untuk hint
  Response: {
    challenge: string (base64url),
    allowedCredentials: [{ id: string, type: "public-key" }]
  }

POST /auth/passkey/auth/finish
  Request: {
    credentialID: string (base64url),
    clientDataJSON: string (base64url),
    authenticatorData: string (base64url),
    signature: string (base64url),
    userID: string? (base64url)
  }
  Response: { token: string, user: { id, name } }

Saat Registrasi (finish):
1. Decode clientDataJSON → verifikasi type = "webauthn.create"
2. Verifikasi challenge cocok dengan yang dikirim (dan belum expired)
3. Verifikasi origin = https://yourdomain.com
4. Verifikasi rpIdHash dalam attestationObject
5. Parse credentialPublicKey dari attestedCredentialData
6. Simpan credentialID + publicKey + userID ke database

Saat Autentikasi (finish):
1. Cari publicKey berdasarkan credentialID
2. Decode clientDataJSON → verifikasi type = "webauthn.get"
3. Verifikasi challenge cocok
4. Verifikasi origin dan rpIdHash
5. Verifikasi UP flag (user present) di authenticatorData
6. Verifikasi signature menggunakan publicKey yang tersimpan
7. Update signCount (opsional, untuk cloning detection)
8. Issue session token