The /auth/passkey/authenticate/options endpoint returns {success, options: {...}} but the login page JS was reading opts.challenge directly instead of opts.options.challenge, causing the WebAuthn ceremony to fail with undefined values.