Craft shipped passkeys, then shipped the one WebAuthn mistake the spec exists to prevent

A captured passkey login request could be replayed indefinitely against Craft, because the server never saved the updated signature counter after a successful login. It's a good excuse to actually explain what a WebAuthn signature counter is for, hung on a real, named bug.