Add WebAuthn config; Docker single-mount

- Add [webauthn] section to all config examples
- Add active WebAuthn config to run/mcias.conf
- Update Dockerfile to use /srv/mcias single mount
- Add WebAuthn and TOTP sections to RUNBOOK.md
- Fix TOTP QR display (template.URL type)
- Add --force-rm to docker build in Makefile

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/ui/handlers_totp.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base32"
 	"encoding/base64"
 	"fmt"
+	"html/template"
 	"net/http"
 
 	qrcode "github.com/skip2/go-qrcode"
@@ -108,7 +109,7 @@ func (u *UIServer) handleTOTPEnrollStart(w http.ResponseWriter, r *http.Request)
 		u.renderTOTPSection(w, r, ProfileData{TOTPError: "internal error"})
 		return
 	}
-	qrDataURI := "data:image/png;base64," + base64.StdEncoding.EncodeToString(png)
+	qrDataURI := template.URL("data:image/png;base64," + base64.StdEncoding.EncodeToString(png)) //nolint:gosec // G203: trusted server-generated data URI
 
 	// Issue enrollment nonce for the confirm step.
 	nonce, err := u.issueTOTPEnrollNonce(acct.ID)
@@ -224,7 +225,7 @@ func (u *UIServer) reissueTOTPEnrollQR(w http.ResponseWriter, r *http.Request, a
 		u.renderTOTPSection(w, r, ProfileData{TOTPError: "internal error"})
 		return
 	}
-	qrDataURI := "data:image/png;base64," + base64.StdEncoding.EncodeToString(png)
+	qrDataURI := template.URL("data:image/png;base64," + base64.StdEncoding.EncodeToString(png)) //nolint:gosec // G203: trusted server-generated data URI
 
 	newNonce, nonceErr := u.issueTOTPEnrollNonce(acct.ID)
 	if nonceErr != nil {