feat: add Passkey authentication with WebAuthn

[StefanSa]

Summary

Adds native Passkey/WebAuthn authentication for Dockhand users.

• Register and manage multiple named Passkeys from Profile → Security
• Sign in without a username or password using discoverable credentials
• Require authenticator user verification
• Keep existing password, LDAP, OIDC and recovery paths unchanged
• Support both SQLite and PostgreSQL

Security

WebAuthn verification uses SimpleWebAuthn and validates the configured canonical ORIGIN/RP ID. Registration is limited to authenticated cookie sessions, challenges are short-lived and single-use, credential ownership is enforced, and successful authentication uses Dockhand's existing session handling.

Validation

• Focused WebAuthn/security tests pass
• SQLite and PostgreSQL persistence covered
• Chromium virtual-authenticator registration → logout → login flow passes
• Manually validated on the deployed Dockhand instance with both a Token2 hardware authenticator and a Bitwarden synced Passkey
• Existing password/recovery behavior remains available
• git diff --check passes

Passkeys registered with a Token2 hardware authenticator and a Bitwarden synced Passkey.

Repository-wide checks contain existing upstream failures unrelated to this change.

Related to #1263.