Add FIDO2/WebAuthn passkey authentication

Phase 14: Full WebAuthn support for passwordless passkey login and
hardware security key 2FA.

- go-webauthn/webauthn v0.16.1 dependency
- WebAuthnConfig with RPID/RPOrigin/DisplayName validation
- Migration 000009: webauthn_credentials table
- DB CRUD with ownership checks and admin operations
- internal/webauthn adapter: encrypt/decrypt at rest with AES-256-GCM
- REST: register begin/finish, login begin/finish, list, delete
- Web UI: profile enrollment, login passkey button, admin management
- gRPC: ListWebAuthnCredentials, RemoveWebAuthnCredential RPCs
- mciasdb: webauthn list/delete/reset subcommands
- OpenAPI: 6 new endpoints, WebAuthnCredentialInfo schema
- Policy: self-service enrollment rule, admin remove via wildcard
- Tests: DB CRUD, adapter round-trip, interface compliance
- Docs: ARCHITECTURE.md §22, PROJECT_PLAN.md Phase 14

Security: Credential IDs and public keys encrypted at rest with
AES-256-GCM via vault master key. Challenge ceremonies use 128-bit
nonces with 120s TTL in sync.Map. Sign counter validated on each
assertion to detect cloned authenticators. Password re-auth required
for registration (SEC-01 pattern). No credential material in API
responses or logs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/templates/fragments/webauthn_enroll.html

@@ -0,0 +1,19 @@
+{{define "webauthn_enroll"}}
+<div id="webauthn-enroll-section">
+  <div id="webauthn-enroll-error" class="alert alert-error" style="display:none" role="alert"></div>
+  <div id="webauthn-enroll-success" class="alert alert-success" style="display:none" role="alert"></div>
+  <div class="form-group">
+    <label for="webauthn-name">Passkey Name</label>
+    <input class="form-control" type="text" id="webauthn-name" placeholder="e.g. YubiKey 5" value="Passkey">
+  </div>
+  <div class="form-group">
+    <label for="webauthn-password">Current Password</label>
+    <input class="form-control" type="password" id="webauthn-password" autocomplete="current-password">
+  </div>
+  <div class="form-actions">
+    <button class="btn btn-primary" type="button" id="webauthn-enroll-btn">
+      Add Passkey
+    </button>
+  </div>
+</div>
+{{end}}