Passkey Signup Finish

Completes a passkey-only signup: verifies the attestation against the handle from beginPasskeySignup, then in one transaction creates the person (no email, no phone), their user account in the workspace, a passkey identity link and the passkey, and signs them in (the session's amr is ["passkey"]). The new person can sign in and join other open workspaces, but creating a workspace or sending invites answers 403 verified_email_required until they verify an email. Refusals: 400 passkey_failed (stale, reused or foreign handle; bad attestation, origin or relying party; no user verification; a passkey already registered), plus begin's workspace refusals, re-checked here (registration_rejected, wrong_auth_scheme, passkey_signup_unavailable, 429 passkey_signup_limit_reached).