Handles the JSON endpoints mounted by Ithibati.Web.Router.

Registration and authentication each use a challenge request followed by verification. Challenges occupy separate session entries, and each carries its mount settings. Registration also retains the subject approved by Ithibati.Web.Handler.registration_subject/2. Verification removes the session entry and atomically consumes its database record before checking it. Old cookies and concurrent requests cannot reuse that record, even after failure.

Separate entries prevent an authentication challenge from being used to bypass registration approval. Matching the mount settings prevents a challenge from being completed through a different handler or ceremony configuration.

Recovery redeems a code in one request without a WebAuthn challenge. Successful verification or redemption delegates to the application's Ithibati.Web.Handler. Atom error reasons become JSON strings with status 422; other reasons become verification_failed.