feat(auth): add passkey support

[Siumauricio]

Summary

Adds WebAuthn passkeys via better-auth's @better-auth/passkey plugin (same scoped-package family as sso/scim/api-key, pinned to 1.6.23).

• Server: passkey() plugin registered in auth.ts (mirrored in auth-cli.ts). rpID/origin are derived from the request, so it works for both IP and custom-domain panels without config.
• DB: new passkey table (+ indexes on user_id / credential_id), migration 0177_glossy_brother_voodoo.sql.
• Profile: new "Passkeys" dialog next to the 2FA buttons — list, register (named), and remove passkeys.
• Login: "Sign in with Passkey" button below the credentials form; cancelled WebAuthn prompts don't surface as errors.
• Session: freshAge: 0 — otherwise sessions older than 24h get a 403 "Session is not fresh" when managing passkeys (Dokploy doesn't use any other better-auth endpoint gated by freshness; password changes still require the current password).

Greptile Summary

Adds Better Auth passkey support across authentication, persistence, login, and profile management.

• Registers the passkey server and client plugins.
• Adds the passkey table, migration, schema, and listing service.
• Adds passkey enrollment, deletion, and sign-in interfaces.

Confidence Score: 4/5

The PR does not appear safe to merge until the outstanding global session-freshness bypass is fixed.

The runtime auth configuration still sets freshAge: 0 while passkey enrollment remains directly reachable, leaving the previously reported path for an older stolen session to register a durable credential.

Files Needing Attention: packages/server/src/lib/auth.ts

_{Reviews (3): Last reviewed commit: "fix(build): exclude CLI-only auth config..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Authentication, Organizations, and Permissions

[greptile-apps]

Global freshness boundary disabled

If an attacker holds an older but still-valid session, freshAge: 0 makes fresh-session middleware skip its age check, allowing that session to enroll an attacker-controlled passkey and establish durable account access; this global setting also removes freshness protection from other sensitive better-auth operations such as account unlinking.

How this was verified: Better-auth treats zero as disabling the age check, and passkey registration uses its fresh-session middleware.

Knowledge Base Used: Authentication, Organizations, and Permissions