Index: src/services/PasskeyService.js
===================================================================
--- src/services/PasskeyService.js	(revision 9e9e6f98000b96d6c64d6c0cc5d9eb951ada9804)
+++ src/services/PasskeyService.js	(revision d43230fb28a7eb53abe716d29d94f498410f4edd)
@@ -7,5 +7,9 @@
 import crypto from 'crypto';
 import db from '../config/database.js';
-import { generateRegistrationOptions, verifyRegistrationResponse } from '@simplewebauthn/server';
+
+// Lazy so a not-yet-installed dependency can never crash app boot; only the
+// paid passkey flow fails until `npm ci` has run.
+let _lib = null;
+async function lib() { if (!_lib) _lib = await import('@simplewebauthn/server'); return _lib; }
 
 const DEFAULT_TTL_DAYS = 32;   // aligns with Patreon's monthly cycle; re-link after
@@ -21,4 +25,5 @@
 export async function registrationOptions(base, siteSlug) {
   const { rpID } = rpFor(base);
+  const { generateRegistrationOptions } = await lib();
   return generateRegistrationOptions({
     rpName: `Supporter of ${siteSlug}`,
@@ -39,4 +44,5 @@
   let v;
   try {
+    const { verifyRegistrationResponse } = await lib();
     v = await verifyRegistrationResponse({
       response,