fix(orchestrator): one passkey request at a time

With two passkey requests open at once, the hub received one request's payload with the other request's assertion and refused it with the challenge is not the one of the payload. signedProof now refuses a second signing while one runs and tells the operator to finish the first.

🎯 Fix: 89 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 85
🚦 Gate: ⛔ fix 89 % < 90: operator approved the commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/templates/page-passkey.js

@@ -32,7 +32,9 @@
     }
   }
 
-  async function signedProof(path, fields, label) {
+  let signing = false;
+
+  async function prove(path, fields, label) {
     const result = await sendJson(path, fields);
     if (!result.ok || !result.data) {
       toast(`${label}: not possible`, fail(result), false);
@@ -45,6 +47,19 @@
     return signed ? {proof: {payload: result.data.payload, assertion: signed}} : null;
   }
 
+  async function signedProof(path, fields, label) {
+    if (signing) {
+      toast(`${label}: not signed`, ["Another passkey signature is still open: finish or cancel it first; nothing was sent."], false);
+      return null;
+    }
+    signing = true;
+    try {
+      return await prove(path, fields, label);
+    } finally {
+      signing = false;
+    }
+  }
+
   function proofFor(entries, label) {
     return signedProof("/api/sign", {items: entries}, label);
   }