Implementing Device Bound Session Credentials (DBSC) on Express

Chrome 146 shipped DBSC to stable. Here's how to bind your session cookies to the user's hardware key on an Express server — and the wire-format details that silently kill the session if you get them wrong.