## Summary
## Spec reference
## Checklist
- [ ] `cargo build` passes
- [ ] `cargo test` passes — all existing tests green, new tests added for changed behaviour
- [ ] `cargo clippy -- -D warnings` passes — zero warnings
- [ ] `cargo fmt` applied
- [ ] W3C spec step comments present for any changes to `registration.rs` or `authentication.rs`
- [ ] `docs/` updated if behaviour or architecture changed
- [ ] `CLAUDE.md` updated if crate structure or design decisions changed
- [ ] "Known limitations" in `CLAUDE.md` updated if a limitation was resolved
- [ ] New `WebAuthnError` variants have `///` doc comments and test coverage
- [ ] No `unwrap()` in library code (tests and demo are fine)
- [ ] No `git push` performed — push is always manual