both webauthn vars use punycode for internationalized domains

.env.example

@@ -13,9 +13,10 @@ JWT_SECRET=
 ALTCHA_HMAC_KEY=
 
 # WebAuthn / Passkey (set these to your actual domain)
-# If your domain has non-ASCII characters (umlauts, accents, etc.):
-#   RP_ID uses the unicode version: feedback.example.de
-#   ORIGIN uses the punycode version: https://xn--feedbck-example.de
+# If your domain has non-ASCII characters (umlauts, accents, etc.),
+# use the punycode version for BOTH RP_ID and ORIGIN:
+#   WEBAUTHN_RP_ID=xn--splung-4ya.ich-stuhle.de
+#   WEBAUTHN_ORIGIN=https://xn--splung-4ya.ich-stuhle.de
 # You can find the punycode version by opening the domain in a browser and copying from the address bar.
 WEBAUTHN_RP_NAME=Echoboard
 WEBAUTHN_RP_ID=example.com