Optional per WebAuthn. Browser callers can omit this and rely on the effective domain. Native bridges may still require an explicit RP ID (for example, iOS bridge validation).