Add WebAuthn config; Docker single-mount

- Add [webauthn] section to all config examples
- Add active WebAuthn config to run/mcias.conf
- Update Dockerfile to use /srv/mcias single mount
- Add WebAuthn and TOTP sections to RUNBOOK.md
- Fix TOTP QR display (template.URL type)
- Add --force-rm to docker build in Makefile

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/templates/account_detail.html

@@ -60,6 +60,12 @@
 <div class="card">
   <h2 style="font-size:1rem;font-weight:600;margin-bottom:1rem">Passkeys</h2>
   {{template "webauthn_credentials" .}}
+  {{if eq (string .Account.AccountType) "human"}}
+  <p class="text-muted text-small" style="margin-top:.75rem">
+    Passkey enrollment is self-service. The account holder can add passkeys from their
+    <a href="/profile">Profile</a> page.
+  </p>
+  {{end}}
 </div>
 {{end}}
 <div class="card">