WebAuthn enrollment succeeds, but the stored rpId still points at the old domain after a production cutover

Users can register credentials, yet sign-in later fails because the relying party identity was not updated with the new canonical hostname.