Passkeys, part 1: a signed-in person adds, uses and removes passkeys, and signs in with one #1617

Replaces half of #667. The earlier run timed out because the whole issue was too much for one run.

Done looks like

• [ ] A small WebAuthn module with no dependency, unless the pull justifies one in the README. It covers registration and assertion for ES256 and RS256, with challenge, origin, rpId and signCount checks, and plain data in and out.
• [ ] Settings → Passkeys lists, adds and removes passkeys. One account can hold several.
• [ ] On the sign-in page, a passkey issues the same forge session as a password.
• [ ] Tests with a software authenticator in the test file: register, sign in, and remove. They also check that a wrong origin, a replayed challenge and a signCount that goes backwards are each refused. Each new test file is listed in GATE.

Files: src/auth/webauthn.ts (new), the Settings and sign-in pages, a named migration, test/. Not in this part: sign-up changes and recovery.

Parked by the crew: the check failed ("acting on many asks at once > the card's one request answers its script with the region and the count; one undo link stays for a day") and the decider saw no point in another try (pull #1672 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("home is the feed > On you can be cleared in one move: a box each, select all, by kind and by repository, one form") and the decider saw no point in another try (pull #1677 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("acting on many asks at once > the card's one request answers its script with the region and the count; one undo link stays for a day") and the decider saw no point in another try (pull #1672 closed)
2. the check failed ("home is the feed > On you can be cleared in one move: a box each, select all, by kind and by repository, one form") and the decider saw no point in another try (pull #1677 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split. Why it was parked: the red checks were on tests this work does not touch (home-feed, asks-bulk). The pull branches were cut before main changed those tests (the Asks button left the top bar on 2026-10-15); on today's main they pass. Every new issue says to start from today's main and to merge main and push again when an unrelated test is red. The WebAuthn module, the bulk of the work, is now its own piece: #1693, then #1694 (Settings → Passkeys and sign-in with a passkey). #1618 now waits for #1694.