Complete WebAuthn web handlers and download real htmx

- Real htmx.min.js (v2.0.4, 50KB) replaces stub
- WebAuthn registration handlers (begin/finish) for adding security keys
- WebAuthn login handlers (begin/finish) for passwordless login
- Key management page (list/delete registered keys)
- Login page updated with "Login with Security Key" button + JS
- Session store for WebAuthn ceremonies (mutex-protected map)
- WebAuthn config passed from server command through to webserver
- Added LookupUserID helper for username-based WebAuthn login

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/auth/users.go

@@ -31,6 +31,16 @@ func CreateUser(database *sql.DB, username, password string, params Argon2Params
 	return res.LastInsertId()
 }
 
+// LookupUserID returns the user ID for a username, or an error if not found.
+func LookupUserID(database *sql.DB, username string) (int64, error) {
+	var userID int64
+	err := database.QueryRow("SELECT id FROM users WHERE username = ?", username).Scan(&userID)
+	if err != nil {
+		return 0, fmt.Errorf("user not found: %w", err)
+	}
+	return userID, nil
+}
+
 // AuthenticateUser verifies username/password and returns the user ID.
 func AuthenticateUser(database *sql.DB, username, password string) (int64, error) {
 	var userID int64