Passkeys, part 2a: sign-up takes a passkey and an email, and no door makes a password-only account #1996

Replaces the sign-up half of #1618 (pulls #1891 and #1960 red, both on main's own faults).

Done looks like:

• [ ] Sign-up registers a passkey and an email address, using src/auth/webauthn.ts and src/core/passkeys.ts as they are. No path creates a new account with only a password: not the web form, not the API, not the terminal.
• [ ] Existing password accounts still sign in. Settings → Passkeys invites them to add one, in one line. A code comment says when password sign-in can be removed.
• [ ] Recovery is not in this issue.
• [ ] Tests in a new file named in GATE: passkey sign-up creates the account and its email; a password-only sign-up is refused on each door with words written for anyone; an existing password account still signs in.

Files: the sign-up action and page (src/web/pages/site.ts, src/actions/), src/http/server.ts only where sign-up is routed, a new test. Start from today's main, at or after c889df7b. Earlier tries went red on "the release record is newest first" and "/boards > a panel keeps its chart and series". Both were main's own faults, fixed in 39e98bc9 and 43bf1e57, and the builder did not cause them. Name a new migration src/core/migrations/<UTC yyyymmddHHMMSS>-<name>.ts (see 20261015230000-a-domain-drill.ts), never by number, and do not edit src/core/releases.json by hand. Before pushing, run bun x tsc --noEmit, the tests this touches, the schema-migrations and schema-additive tests if you add a migration, and test/check-list.test.ts. Name every new test file in GATE in scripts/gate.ts in the same commit. No test bounds a request or a spawn by wall-clock time. A test that goes red in this pull is fixed in this pull.