Verify the touch and return proof of it

Verifies the assertion — origin, rpIdHash, the user-verified flag, the signature, and a sign count that must increase, which is what catches a cloned authenticator — and returns a short-lived token proving this user touched their authenticator over that digest.

The token records that a platform app requested it. That provenance is deliberate: it proves the touch to your application, and it is refused as authorization for a 1Claw treasury transfer. A user consenting to your action has not consented to moving funds, and those remain a separate assertion from the user's own session.