v0.3.1

Added

• Related origin requests - one rp_id usable from several domains. Passki::related_origins()
  returns a serializable RelatedOrigins for the /.well-known/webauthn file, listing the accepted
  origins that the rp_id does not already reach. Verification needed no change: origins were
  already matched against the configured list, independently of the rp_id.
• Signal API - UnknownCredentialSignal, AllAcceptedCredentialsSignal and
  CurrentUserDetailsSignal, built by Passki::signal_unknown_credential(),
  signal_all_accepted_credentials() and signal_current_user_details(). Each fills in the
  rp_id and base64url-encodes the identifiers, so the payload can be returned to the page and
  handed to the matching PublicKeyCredential method.
• Authenticator extension outputs - parse_auth_data now reads the CBOR extension block that
  closes out authenticator data, gated on the ED flag. Internal for now; it is what credProtect
  and minPinLength will read.

Changed

• All five framework examples use the Signal API: registration and a successful sign-in return the
  account's passkey list and display name, and a sign-in naming a credential the server does not
  hold returns the unknown-credential signal. That last case now answers 200 with
  success: false and the payload, where it previously returned 400 with a plain-text body.
• The shared examples/index.html gained processSignals(), which feature-detects each
  PublicKeyCredential.signal* method and logs rather than throws when one is rejected.