feat(auth): add passkey credential foundation

[hmans]

Summary

• Adds opt-in passkey configuration, a secure WebAuthn relying-party factory, and additive server-discovery capability metadata.
• Introduces durable credential-hash aggregates and a dedicated projection so passkey ownership, lookup, unlinking, and account deletion use scoped OCC rather than global user-stream scans.
• Extends recovery and auth-generation behavior so sign-in-method removal accounts for passkeys and revokes stale sessions.
• Documents the operator configuration and regenerates the affected API bindings and reference documentation.

Verification

• mise x -- go test ./internal/config ./internal/passkeys ./internal/core -run 'Passkey|AuthenticationRevoked|AuthGeneration' -timeout 60s
• mise x -- go test ./internal/core ./internal/events -run 'Passkey|ProjectionSubjects' -timeout 60s

Closes #1442.