Passkeys: Settings → Passkeys lists, adds and removes them, and signing in with one issues the same session as a password #1694

Split from #1617. Done: a named migration for passkeys (several per account), the page and its same-origin-checked actions through src/auth/webauthn.ts; the sign-in page offers a passkey and a good assertion gives the same HttpOnly session cookie; tests: add two, remove one, sign in with the other, the removed one is refused.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.