Handles the JSON endpoints mounted by Ithibati.Web.Router.

Registration and authentication each use a challenge request followed by verification. Challenges occupy separate session entries, and each carries its mount settings. Registration also retains the subject approved by Ithibati.Web.Handler.registration_subject/2. The session may be a cookie of at most 4096 bytes, so an entry keeps the retained form of its challenge and an approved account's id. Verification rebuilds the challenge from the mount's ceremony options and loads the account again; an account removed meanwhile is refused. Verification removes the session entry and atomically consumes its database record before checking it. Old cookies and concurrent requests cannot reuse that record, even after failure.

Separate entries prevent an authentication challenge from being used to bypass registration approval. Matching the mount settings prevents a challenge from being completed through a different handler or ceremony configuration.

Recovery redeems a code in one request without a WebAuthn challenge. Successful verification or redemption delegates to the application's Ithibati.Web.Handler. Atom error reasons become JSON strings with status 422; other reasons become verification_failed.