Add FIDO2/WebAuthn passkey authentication

Phase 14: Full WebAuthn support for passwordless passkey login and
hardware security key 2FA.

- go-webauthn/webauthn v0.16.1 dependency
- WebAuthnConfig with RPID/RPOrigin/DisplayName validation
- Migration 000009: webauthn_credentials table
- DB CRUD with ownership checks and admin operations
- internal/webauthn adapter: encrypt/decrypt at rest with AES-256-GCM
- REST: register begin/finish, login begin/finish, list, delete
- Web UI: profile enrollment, login passkey button, admin management
- gRPC: ListWebAuthnCredentials, RemoveWebAuthnCredential RPCs
- mciasdb: webauthn list/delete/reset subcommands
- OpenAPI: 6 new endpoints, WebAuthnCredentialInfo schema
- Policy: self-service enrollment rule, admin remove via wildcard
- Tests: DB CRUD, adapter round-trip, interface compliance
- Docs: ARCHITECTURE.md §22, PROJECT_PLAN.md Phase 14

Security: Credential IDs and public keys encrypted at rest with
AES-256-GCM via vault master key. Challenge ceremonies use 128-bit
nonces with 120s TTL in sync.Map. Sign counter validated on each
assertion to detect cloned authenticators. Password re-auth required
for registration (SEC-01 pattern). No credential material in API
responses or logs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/templates/account_detail.html

@@ -15,6 +15,7 @@
     <dt class="text-muted">Status</dt>
     <dd id="status-cell">{{template "account_status" .}}</dd>
     <dt class="text-muted">TOTP</dt><dd>{{if .Account.TOTPRequired}}Enabled{{else}}Disabled{{end}}</dd>
+    {{if .WebAuthnEnabled}}<dt class="text-muted">Passkeys</dt><dd>{{len .WebAuthnCreds}} registered</dd>{{end}}
     <dt class="text-muted">Created</dt><dd class="text-small">{{formatTime .Account.CreatedAt}}</dd>
     <dt class="text-muted">Updated</dt><dd class="text-small">{{formatTime .Account.UpdatedAt}}</dd>
   </dl>
@@ -44,6 +45,12 @@
   <div id="token-delegates-section">{{template "token_delegates" .}}</div>
 </div>
 {{end}}
+{{if .WebAuthnEnabled}}
+<div class="card">
+  <h2 style="font-size:1rem;font-weight:600;margin-bottom:1rem">Passkeys</h2>
+  {{template "webauthn_credentials" .}}
+</div>
+{{end}}
 <div class="card">
   <h2 style="font-size:1rem;font-weight:600;margin-bottom:1rem">Tags</h2>
   <div id="tags-editor">{{template "tags_editor" .}}</div>

web/templates/fragments/webauthn_credentials.html

@@ -0,0 +1,30 @@
+{{define "webauthn_credentials"}}
+<div id="webauthn-credentials-section">
+{{if .WebAuthnCreds}}
+<table class="table" style="font-size:.85rem;margin-bottom:1rem">
+  <thead>
+    <tr><th>Name</th><th>Created</th><th>Last Used</th><th>Sign Count</th><th></th></tr>
+  </thead>
+  <tbody>
+  {{range .WebAuthnCreds}}
+    <tr>
+      <td>{{.Name}}{{if .Discoverable}} <span class="badge" title="Passkey (discoverable)">passkey</span>{{end}}</td>
+      <td class="text-small">{{formatTime .CreatedAt}}</td>
+      <td class="text-small">{{if .LastUsedAt}}{{formatTime (derefTime .LastUsedAt)}}{{else}}Never{{end}}</td>
+      <td>{{.SignCount}}</td>
+      <td>
+        <button class="btn btn-sm btn-danger"
+                hx-delete="{{$.DeletePrefix}}/{{.ID}}"
+                hx-target="#webauthn-credentials-section"
+                hx-swap="outerHTML"
+                hx-confirm="Remove this passkey?">Remove</button>
+      </td>
+    </tr>
+  {{end}}
+  </tbody>
+</table>
+{{else}}
+<p class="text-muted text-small">No passkeys registered.</p>
+{{end}}
+</div>
+{{end}}

web/templates/fragments/webauthn_enroll.html

@@ -0,0 +1,19 @@
+{{define "webauthn_enroll"}}
+<div id="webauthn-enroll-section">
+  <div id="webauthn-enroll-error" class="alert alert-error" style="display:none" role="alert"></div>
+  <div id="webauthn-enroll-success" class="alert alert-success" style="display:none" role="alert"></div>
+  <div class="form-group">
+    <label for="webauthn-name">Passkey Name</label>
+    <input class="form-control" type="text" id="webauthn-name" placeholder="e.g. YubiKey 5" value="Passkey">
+  </div>
+  <div class="form-group">
+    <label for="webauthn-password">Current Password</label>
+    <input class="form-control" type="password" id="webauthn-password" autocomplete="current-password">
+  </div>
+  <div class="form-actions">
+    <button class="btn btn-primary" type="button" id="webauthn-enroll-btn">
+      Add Passkey
+    </button>
+  </div>
+</div>
+{{end}}

web/templates/login.html

@@ -29,10 +29,24 @@
           <button class="btn btn-primary" type="submit" style="width:100%">Sign in</button>
         </div>
       </form>
+      {{if .WebAuthnEnabled}}
+      <div style="margin-top:1rem;text-align:center">
+        <div style="display:flex;align-items:center;gap:.75rem;margin-bottom:.75rem">
+          <hr style="flex:1;border:0;border-top:1px solid #ddd">
+          <span class="text-muted text-small">or</span>
+          <hr style="flex:1;border:0;border-top:1px solid #ddd">
+        </div>
+        <div id="webauthn-login-error" class="alert alert-error" style="display:none" role="alert"></div>
+        <button class="btn btn-secondary" type="button" id="webauthn-login-btn" style="width:100%">
+          Sign in with passkey
+        </button>
+      </div>
+      {{end}}
     </div>
   </div>
 </div>
 <script src="/static/htmx.min.js"></script>
+{{if .WebAuthnEnabled}}<script src="/static/webauthn.js"></script>{{end}}
 </body>
 </html>
 {{end}}

web/templates/profile.html

@@ -4,6 +4,18 @@
 <div class="page-header">
   <h1>Profile</h1>
 </div>
+{{if .WebAuthnEnabled}}
+<div class="card">
+  <h2 style="font-size:1rem;font-weight:600;margin-bottom:1rem">Passkeys</h2>
+  <p class="text-muted text-small" style="margin-bottom:.75rem">
+    Passkeys let you sign in without a password using your device's biometrics or a security key.
+  </p>
+  {{template "webauthn_credentials" .}}
+  <h3 style="font-size:.9rem;font-weight:600;margin:1rem 0 .5rem">Add a Passkey</h3>
+  {{template "webauthn_enroll" .}}
+</div>
+<script src="/static/webauthn.js"></script>
+{{end}}
 <div class="card">
   <h2 style="font-size:1rem;font-weight:600;margin-bottom:1rem">Change Password</h2>
   <p class="text-muted text-small" style="margin-bottom:.75rem">