Add WebAuthn passkey second factor

[TheSilkky]

Closes #276

Target base branch

• Base: develop
• Head: codex/issue-276-webauthn-passkey-second-factor

Summary

• Adds disabled-by-default WebAuthn/FIDO2 passkey and roaming security-key second-factor support using github.com/go-webauthn/webauthn/webauthn.
• Adds fail-closed RP/origin configuration with exact allowed origins, HTTPS enforcement except explicit local development origins, user-verification policy, and WebAuthn challenge TTL controls.
• Adds SQLite and PostgreSQL WebAuthn user, credential, and one-time challenge persistence, including webauthn session-method support.
• Adds authenticated registration and verification routes for bearer and browser-cookie sessions, route-limit classification, setup/access gating integration, focused tests, and documentation.

Validation

• gofmt -w ./cmd ./internal ./migrations
• go test ./internal/auth ./internal/config ./internal/incidents ./internal/postgresdb ./internal/httpapi ./cmd/api
• go test ./...
• go vet ./...
• git diff --check

Docs

• Updated README, SECURITY, API/config/deployment/access-control/security/threat-model docs, logging requirements, code map, v1 preview direction, changelog, and sample proofline.toml.

Revalidation

• Revalidated against origin/develop at 69397bd217c62b4d050070af08ce8d9ad57186ec.
• Add required-2FA account state, setup gating, and migrations #273, Add email challenge second-factor setup and verification #274, and Add TOTP second-factor setup and verification #275 are closed and current develop contains the required account setup, email challenge, and TOTP second-factor commits.

Key custody and decryption

• No backend decryption, browser decryption, raw key handling, key escrow, or key-custody assumption changes are introduced.

Review state

• Opened as a non-draft PR per maintainer open-PR override; it still requires maintainer/human review before merge.