Every one of these was avoidable, and every one of them taught me more than the successful deploys did.
The repeatable process that turns a vague client brief into a shipped, maintainable site — not the parts, the order they happen in.
WebAuthn's spec is intimidating, but the production gotchas aren't in the crypto — they're in the details nobody's blog post mentions.