A verification server accepts only valid zero-knowledge proofs.
POST /challenge {"action": "start"}
→ {sid, root, original_leaf, siblings, direction_bits, ttl_ms, target_leaf}
POST /challenge {"action": "submit", "sid": ..., "proof": ..., "publicSignals": [...]}
→ {flag} if the proof checks out
A session lives for 20 seconds and can be submitted once.