Keep a new passkey

Checks what the browser made from the options of `POST /v1/passkeys/registration-options` (its challenge, origin, relying party and user verification) and keeps it, and emails the person's verified address that a passkey was added. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it. Recorded as `user.passkey_added`.

curl -X POST "https://example.com/v1/passkeys" \  -H "Content-Type: application/json" \  -d '{    "credential": {      "property1": null,      "property2": null    }  }'

{  "id": "string",  "synced": true,  "backed_up": true,  "transports": [    "string"  ],  "created_at": "2019-08-24T14:15:22Z",  "last_used_at": "2019-08-24T14:15:22Z"}