Verify a WebAuthn authentication assertion and issue JWT session cookies.

The request body must include:

• id (str): Base64url-encoded credential ID from the assertion.
• challenge (str): Base64url-encoded challenge echoed back by the frontend. The frontend should extract this from the challenge field returned by passkey_authenticate_start so the server can look up the expected bytes.
• response (dict): The AssertionResponse from navigator.credentials.get().

On success, sets JWT access + refresh cookies on the response and returns the authenticated user's profile so the frontend can update its user store.

Authentication: AllowAny.

Returns: 200 — Authenticated. Body: {status: "authenticated", user: {...}}. 400 — Missing/expired challenge or webauthn verification failed. 404 — Credential ID not found in the database.