feat: add passkey (WebAuthn) authentication support

[jimmitchell]

Summary

• Adds passwordless login via device biometrics or PIN as an alternative to username/password
• Supports multiple named passkeys (one per device) managed from the Account page
• Uses lbuchs/webauthn ^2.2 for server-side WebAuthn verification
• Bumps version to v1.1.0

Changes

• composer.json — adds lbuchs/webauthn ^2.2
• src/Database.php — schema v12 migration adds passkeys table
• src/Auth.php — adds hasPasskeys, getPasskeys, passkeyRegisterOptions, passkeyRegisterComplete, passkeyAuthOptions, passkeyAuthVerify, and webAuthn methods
• admin/passkey-api.php — new session-based JSON API for WebAuthn registration and authentication
• admin/index.php — adds "Sign in with a passkey" button above the password form (shown only when passkeys are registered)
• admin/account.php — adds passkey management panel with list, register, and remove actions
• admin/assets/admin.css — adds .btn--passkey and .login-divider styles

Test plan

• Log in with password → Account → Register a passkey (browser prompts for biometric/PIN)
• Log out → "Sign in with a passkey" button appears → click → authenticate
• Verify passkey appears in account page with name, registered date, and last-used date
• Register a second passkey with a different name — both appear in the list
• Remove a passkey — it disappears and can no longer be used to log in
• Check login log — passkey_login, passkey_add, and passkey_remove entries appear

🤖 Generated with Claude Code