task(auth): add per-uid rate limiting to passkey auth failures

[dschom]

Because

• We want to rate limit failures since this is a more clear signal of repeated attempts.

This pull request

• Updates passkey AppErrors to take a UID, so we can rate limit on failure.
• In the event of failure, we now look up the account and run a rate limit check.
• Adds configuration that limits repeated passkey failures on an account.

Issue that this pull request solves

Closes: FXA-13675

Checklist

Put an `x` in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to Test

• Edit rate-limit-rules.txt to set a tight `passkeyAuthFinishFailed` rule (e.g. 1 attempt per 10 minutes by uid) for fast verification
• Sign in to a test account that has a registered passkey.
• Sign out and trigger `POST /passkey/authentication/finish` repeatedly with a tampered/invalid assertion against the same account.
• Observer the rate limiting failure.

[Copilot]

Pull request overview

Adds per-UID rate limiting for passkey authentication finish failures by propagating uid context through passkey verification errors and enforcing a new customs action when failures occur. This helps throttle repeated failed assertions against a specific account, reducing signal-noise compared to IP-only limits.

Changes:

• Extend AppError passkey failure helpers to optionally carry an internal-only uid field (not serialized in responses).
• Attach uid to passkey verification failures once the credential owner is known, and consume it in the auth-server route to run a per-uid customs check on failure.
• Add new passkeyAuthFinishFailed rate-limit rules plus unit tests covering the new behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/fxa-auth-server/lib/routes/passkeys.ts	Runs a per-uid customs rate-limit check when authenticationFinish fails with an AppError that includes uid.
packages/fxa-auth-server/lib/routes/passkeys.spec.ts	Adds route tests ensuring customs per-uid failure recording and rate-limit error propagation.
packages/fxa-auth-server/config/rate-limit-rules.txt	Introduces passkeyAuthFinishFailed rules (uid + ip).
libs/accounts/passkey/src/lib/passkey.service.ts	Attaches uid to thrown passkey auth AppErrors after credential resolution.
libs/accounts/passkey/src/lib/passkey.service.spec.ts	Adds tests verifying uid is/ isn’t attached depending on failure stage.
libs/accounts/errors/src/index.spec.ts	Adds assertions that uid is attached when provided and not leaked to payload.
libs/accounts/errors/src/app-error.ts	Adds uid?: string to AppError and updates passkey error factories to accept optional uid.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.