Static fixture page. The WebAuthn ceremony is invoked by the test harness through browser automation. No secrets, no third-party scripts.