- ceremony: default UV to REQUIRED so WebAuthn4J enforces flagUV (#2)
- ceremony: refuse the non-strict WebAuthnManager when attestation conveyance
  is not NONE; force operators to wire a strict manager explicitly (#3)
- jwt(spring): fail-fast on HS256 secrets shorter than 32 bytes; remove the
  silent expand() helper that masked weak keys (#4)
- jwt(micronaut): fail-fast on blank or short HS256 secrets; remove the
  zero-pad and random-on-blank fallbacks (#5)
- persistence: make signCount updates atomic against concurrent racing
  assertions so clone detection cannot be silently defeated — JDBI adds
  AND sign_count < :sc, DynamoDB adds a conditional UpdateItem (#6)
- starters: gate LoggingEmailSender / LoggingSmsSender behind dev-mode so
  magic-link tokens and OTP codes don't silently leak to production logs (#7)
- magic-link: replace the unbounded ConcurrentHashMap of consumed JTIs with
  a TTL-bounded Caffeine cache; fix the Javadoc to match reality (#8)
- magic-link: bind verification email to the user via UserLookup#emailFor
  and reject mismatches; admin service maps the new EmailMismatch result to
  a 400 (#9)
- persistence(dynamodb): server-enforce single-use for backup-code consume
  and OTP consume/incrementAttempts via ConditionExpression (#10)
- persistence(dynamodb): server-enforce challenge expiry in takeOnce
  via ConditionExpression on expiresAt instead of post-filtering in Java (#11)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

#9  — Dropwizard auto-wires OTP/MagicLink/BackupCode via AltFlowsModule + new bundle ctor
#10 — shared BackupCodesCountResponse / EmailVerificationResult in pk-auth-admin-api
#11 — shared AdminRequests records in pk-auth-admin-api; all three adapters consume them
#12 — AdminErrorBody + test deleted; DESIGN.md error envelope aligned with mappers
#14 — new OtpPepperResolver in pk-auth-otp; Spring + Micronaut adapters share it
#16 — Micronaut credential-id path template renamed to {credentialId}
#17 — Spring toResponse collapsed into single entrypoint auto-detecting null → 204
#19 — RelyingParty defaults dropped in Spring and Micronaut; fail fast
#20 — JWT defaults dropped; new JwtSecretResolver in pk-auth-jwt; Spring random-key fallback removed
#21 — typed boolean devMode added to PkAuthProperties / PkAuthConfiguration
#26 — ChallengeStore.put Javadoc + TTL validation; all three impls enforce
#27 — BackupCodeRepository.replaceAll abstract; DynamoDB impl uses TransactWriteItems
#29 — UserLookup methods renamed; USERNAMELESS_KEY constant added (#36 bundled)
#30 — AssertionResult.Success convenience constructor removed

Blocked: #13, #15, #22, #23, #24, #25, #31 — deferred per user pause

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>