feat(auth): add passkey user flows

[alexj11324]

Summary / 摘要

• Add browser-native passkey sign-in while preserving the existing password, LDAP, SSO, and recovery paths.

• Keep the explicit sign-in loading state active across the begin request, native navigator.credentials.get() handoff, and finish request; duplicate submissions are rejected while pending.

• Add authenticated passkey registration and credential management with user-visible names, created/last-used metadata, rename, revoke, empty/loading/error states, and duplicate-submit protection.

• Keep one registration loading state active across the begin request, native navigator.credentials.create() handoff, finish request, and refresh.

• Use unchanged provider-neutral FIDO Alliance Passkey Mark A SVG assets with source hashes, usage guidance, and accessible visible labels.

• Use the platform WebAuthn APIs already available in supported browsers; no authentication dependency or parallel account owner is added.

• This PR has breaking changes.
  / 此 PR 包含破坏性变更。

• This PR changes public API, config, storage format, or migration behavior.
  / 此 PR 修改了公开 API、配置、存储格式或迁移行为。

• This PR requires corresponding changes in related repositories.
  / 此 PR 需要关联仓库同步修改。

Related repository PRs / 关联仓库 PR:

• OpenList: feat(auth): add passkey authentication OpenList#2849
• OpenList-Docs: docs(auth): document passkey deployment OpenList-Docs#348

Testing / 测试

• pnpm test:passkey-registration — 1/1 deterministic pending-state and duplicate-submission regression test passed for shared passkey actions.
• pnpm build — production build passed (1,160 modules transformed).
• pnpm lint — blocked by existing unrelated type errors in Monaco imports, archive preview props, and storage editor discriminated unions; no reported error is in this PR's files.
• Manual test / 手动测试: HTTPS Chrome on macOS with native WebAuthn covered password login, passkey registration/sign-out/sign-in, credential metadata/rename/revoke, revoked-credential rejection, password-login regression, and the loading indicator remaining active through the native credential handoff.

Checklist / 检查清单

• I have read CONTRIBUTING.
  / 我已阅读 CONTRIBUTING。
• I confirm this contribution follows the repository license, contribution policy, and code of conduct.
  / 我确认此贡献符合仓库许可证、贡献规范和行为准则。
• I have formatted the changed code with gofmt, go fmt, or prettier where applicable.
  / 我已按适用情况使用 gofmt、go fmt 或 prettier 格式化变更代码。
• I have requested review from relevant maintainers or code owners where applicable.
  / 我已在适用情况下请求相关维护者或代码所有者审查。

AI Disclosure / AI 使用声明

• This PR includes AI-assisted content.
  / 此 PR 包含 AI 辅助内容。

Tools used / 使用工具:

• ChatGPT
• Codex
• GitHub Copilot
• Claude
• Gemini
• Other (please specify) / 其他（请注明）:

Usage scope / 使用范围:

• Code generation / 代码生成

• Refactoring / 重构

• Documentation / 文档

• Tests / 测试

• Translation / 翻译

• Review assistance / 审查辅助

• I have reviewed and validated all AI-assisted content included in this PR.
  / 我已审核并验证此 PR 中的所有 AI 辅助内容。

• I have ensured that all AI-assisted commits include Co-Authored-By attribution.
  / 我已确保所有 AI 辅助提交都包含 Co-Authored-By 归属信息。

• I can reproduce all AI-assisted content included in this PR without any AI tools.
  / 我可以在没有任何 AI 工具的情况下重现此 PR 中包含的所有 AI 辅助内容。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8f860d8457

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alexj11324]

Final Oracle ARM64 verification for head e39da3e:

• pnpm test:passkey-registration passed.
• pnpm build passed (1,160 modules transformed).
• Chromium over public HTTPS held the registration action in loading-true with a visible spinner while the native credential promise remained pending; a second pointer click was intercepted and did not issue another begin-registration request.
• The same browser run completed password login → passkey registration → passkey login → metadata/rename → revoke → revoked-credential rejection → password-login regression. Console errors and unexpected network failures: zero.
• The deployed public FIDO black/white SVG hashes match the vendor files documented in the asset notice.

GitHub's PR Build Check remains action_required with zero jobs because fork workflows require a repository maintainer's approval; there is no failed CI job to address yet.

[ILoveScratch2]

The FIDO icon is not an open-source asset and does not comply with the project license. If it is absolutely necessary to use the icon and it cannot be replaced, this should be clearly stated elsewhere (not just in public/images). Furthermore, the scope is ambiguous; using These when most files under public/images do not use this license is problematic.

FIDO 图标不是开源资产，不符合项目许可证，如果真的必须使用该图标而不能替换，也应在其他地方显著说明（而非仅在 public/images）且标定范围不明确，使用These但public/images下大部分文件并不使用该许可证。

[ILoveScratch2]

Meaningless encapsulation。

没有意义的封装。