src/auth/webauthn.ts verifies passkey registration and assertion (ES256, RS256) with no dependency, tested with a software authenticator #1693

Split from #1617 (a person's ask). Module only.

Done looks like:

• [ ] Plain data in and out: challenge, origin, rpId and signCount checks.
• [ ] Tests with a software authenticator in the test file: register and assert for both algorithms; a wrong origin, a replayed challenge and a signCount that goes backwards are each refused.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.