Feature Request: Passkey (WebAuthn/FIDO2) support for web UI

Summary

Add support for passkeys as an authentication method in the LibreFang web interface.

Motivation

Currently the web UI requires a username/password login. On mobile devices this is friction-heavy — especially when accessing the interface frequently throughout the day. Passkeys (WebAuthn/FIDO2) would allow users to authenticate using platform authenticators (Touch ID, Face ID, Android biometrics, Windows Hello) with a single tap.

This is particularly valuable for the mobile web UI where typing passwords is cumbersome and password managers have inconsistent autofill behavior.

Expected behavior

1. Registration flow — A user with an existing account can add a passkey in account settings (Settings → Security → Passkeys → Add Passkey). The browser prompts the OS for a platform authenticator or security key.
2. Login flow — On the login page, a "Sign in with passkey" option triggers WebAuthn navigator.credentials.get(). The user authenticates via biometrics or hardware key — no password typed.
3. Multiple passkeys per account — Users can register several devices (phone + laptop, etc.) and name/revoke each individually.
4. Fallback — Password login remains available; passkey is an additive option, not a replacement.

Why this matters for mobile

• iOS Safari and Chrome on Android both have excellent passkey support (stored in iCloud Keychain / Google Password Manager)
• No copy-paste of long tokens from a password manager
• Reduces friction for frequent check-ins on the go

Technical sketch

Standard WebAuthn flow:

Registration:

• POST /api/auth/passkey/registration-options → server returns PublicKeyCredentialCreationOptions
• Browser calls navigator.credentials.create(options)
• POST /api/auth/passkey/registration-verify → server stores credential (credential_id, public_key, sign_count)

Authentication:

• POST /api/auth/passkey/authentication-options → server returns PublicKeyCredentialRequestOptions
• Browser calls navigator.credentials.get(options)
• POST /api/auth/passkey/authentication-verify → server verifies assertion, issues session

Recommended library for the server side: webauthn-rs (Rust) — actively maintained, supports passkeys specifically.

Acceptance criteria

• User can register at least one passkey per account
• User can authenticate using a registered passkey (platform authenticator or roaming key)
• User can view and revoke registered passkeys in account settings
• Password-based login continues to work as fallback
• Works on iOS Safari ≥ 16, Chrome for Android ≥ 108, Chrome/Safari/Firefox desktop

Environment

Web UI, server-side auth layer. No impact on API token or Telegram channel auth.