Passkey: 账户设置绑定 + 免密登录(WebAuthn)

- 引入 go-webauthn, Passkey 表存凭据, challenge 会话内存存储(带过期)
- API: /webauthn/register|login begin/complete, /webauthn/passkeys 列表/删除
- 配置 OT_WEBAUTHN_RP_ID/RP_ORIGIN/RP_NAME;登录成功发 JWT+refresh cookie
- 前端 lib/webauthn(编解码+凭据序列化+安全上下文检测), 账户设置绑定区, 登录页免密按钮
- 需 HTTPS 或 localhost(安全上下文)

Co-Authored-By: Claude <noreply@anthropic.com>

server/internal/api/auth.go

@@ -10,6 +10,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/openteam/server/internal/api/middleware"
 	"github.com/openteam/server/internal/app"
+	"github.com/openteam/server/internal/passkey"
 	"github.com/openteam/server/internal/pkg/resp"
 	"github.com/openteam/server/internal/proxy"
 	"github.com/openteam/server/internal/store"
@@ -17,11 +18,14 @@ import (
 
 // Handler 聚合所有管理 API。
 type Handler struct {
-	a  *app.App
-	gw *proxy.Gateway
+	a        *app.App
+	gw       *proxy.Gateway
+	passkeys *passkey.Service
 }
 
-func NewHandler(a *app.App, gw *proxy.Gateway) *Handler { return &Handler{a: a, gw: gw} }
+func NewHandler(a *app.App, gw *proxy.Gateway, pk *passkey.Service) *Handler {
+	return &Handler{a: a, gw: gw, passkeys: pk}
+}
 
 // ---------------------------------------------------------------------------
 // 认证