Browser-side half of API-hosted QR/passkey sign-in. The QR session uses its
own guest token and never replaces the app's current user until approval.
WebAuthn registration and assertion run on the spoke's API origin, not on
the embedding app's origin.
Browser-side half of API-hosted QR/passkey sign-in. The QR session uses its own guest token and never replaces the app's current user until approval. WebAuthn registration and assertion run on the spoke's API origin, not on the embedding app's origin.