Fix WebAuthn CSRF; clarify security key UI

- Fix webauthn.js CSRF token: read HMAC header value from
  body hx-headers attribute instead of cookie nonce
- Update profile labels to mention security keys/FIDO2
  alongside passkeys

Security: CSRF double-submit was broken for fetch()-based
WebAuthn requests — JS was sending the cookie nonce as the
header value instead of the HMAC. Fixed by reading the
server-rendered header token from the DOM.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/templates/fragments/webauthn_enroll.html

@@ -4,7 +4,7 @@
   <div id="webauthn-enroll-success" class="alert alert-success" style="display:none" role="alert"></div>
   <div class="form-group">
     <label for="webauthn-name">Passkey Name</label>
-    <input class="form-control" type="text" id="webauthn-name" placeholder="e.g. YubiKey 5" value="Passkey">
+    <input class="form-control" type="text" id="webauthn-name" placeholder="e.g. YubiKey 5, Touch ID" value="Passkey">
   </div>
   <div class="form-group">
     <label for="webauthn-password">Current Password</label>