Verify a passkey assertion and issue a session

Unauthenticated. Consumes the challenge issued by /auth/passkey/challenge, verifies the assertion via @simplewebauthn/server, mints Supabase tokens via admin.generateLink(magiclink) for the resolved user (same pattern T3-2c uses for SSO identity linking), and issues mnemom_session with auth_method: 'passkey'. Counter is enforced monotonically — a decrement rejects the assertion. A passkey is a non-SSO credential: if the user's email domain belongs to an org that enforces SSO, no session is minted and the response is 403 sso_required; if that check cannot be completed (including when the user's email cannot be resolved) the response is 503 sso_check_unavailable.