Handles the JSON endpoints mounted by Ithibati.Web.Router.

Registration and authentication each use a challenge request followed by verification. Challenges occupy separate session entries, and each carries its mount settings. Registration also retains the subject approved by Ithibati.Web.Handler.registration_subject/2. Verification removes the corresponding entry from the connection's session before checking it.

Separate entries prevent an authentication challenge from being used to bypass registration approval. Matching the mount settings prevents a challenge from being completed through a different handler or ceremony configuration.

Recovery redeems a code in one request without a WebAuthn challenge. Successful verification or redemption delegates to the application's Ithibati.Web.Handler. Atom error reasons become JSON strings with status 422; other reasons become verification_failed.