Bounded setup

Register your first passkey.

Setup requires a short-lived capability delivered as #setup= in the URL fragment. It is removed before any request and is never stored.

Checking for a setup capability…