Add WebAuthn support for MFA, enabling users to authenticate using security keys, biometrics, or device-based authenticators.

• Registration & verification endpoints
• Support for multiple devices per user
• Fallback to other MFA if WebAuthn unavailable