Complete WebAuthn web handlers and download real htmx

- Real htmx.min.js (v2.0.4, 50KB) replaces stub
- WebAuthn registration handlers (begin/finish) for adding security keys
- WebAuthn login handlers (begin/finish) for passwordless login
- Key management page (list/delete registered keys)
- Login page updated with "Login with Security Key" button + JS
- Session store for WebAuthn ceremonies (mutex-protected map)
- WebAuthn config passed from server command through to webserver
- Added LookupUserID helper for username-based WebAuthn login

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/eng-pad-server/server.go

@@ -74,9 +74,12 @@ func runServer(cmd *cobra.Command, args []string) error {
 
 	// Start Web UI server
 	webSrv, err := webserver.Start(webserver.Config{
-		Addr:    cfg.Web.ListenAddr,
-		DB:      database,
-		BaseURL: cfg.Web.BaseURL,
+		Addr:          cfg.Web.ListenAddr,
+		DB:            database,
+		BaseURL:       cfg.Web.BaseURL,
+		RPDisplayName: cfg.WebAuthn.RPDisplayName,
+		RPID:          cfg.WebAuthn.RPID,
+		RPOrigins:     cfg.WebAuthn.RPOrigins,
 	})
 	if err != nil {
 		return fmt.Errorf("start web: %w", err)