spb/claude-remote

1-- WebAuthn login challenges issued BEFORE an auth session exists (passkey-first login).2-- The browser holds an opaque random token in the short-lived cookie `__Host-cr_pre`;3-- only its sha256 is stored. Rows are single-use (deleted on verification) and expire after 5 min.4CREATE TABLE preauth_challenges (5  token_hash text PRIMARY KEY,6  challenge text NOT NULL,7  ip inet,8  created_at timestamptz NOT NULL DEFAULT now(),9  expires_at timestamptz NOT NULL10);11CREATE INDEX preauth_challenges_expiry_idx ON preauth_challenges(expires_at);12