Passkey: 账户设置绑定 + 免密登录(WebAuthn)

- 引入 go-webauthn, Passkey 表存凭据, challenge 会话内存存储(带过期)
- API: /webauthn/register|login begin/complete, /webauthn/passkeys 列表/删除
- 配置 OT_WEBAUTHN_RP_ID/RP_ORIGIN/RP_NAME;登录成功发 JWT+refresh cookie
- 前端 lib/webauthn(编解码+凭据序列化+安全上下文检测), 账户设置绑定区, 登录页免密按钮
- 需 HTTPS 或 localhost(安全上下文)

Co-Authored-By: Claude <noreply@anthropic.com>

server/internal/api/router.go

@@ -21,7 +21,7 @@ func NewRouter(a *app.App, gw *proxy.Gateway) *gin.Engine {
 	r := gin.New()
 	r.Use(gin.Logger(), gin.Recovery(), middleware.CORS())
 
-	h := NewHandler(a, gw)
+	h := NewHandler(a, gw, a.Passkeys)
 
 	// --- 代理端点（对外）---
 	proxyGroup := r.Group("/v1")
@@ -67,6 +67,16 @@ func NewRouter(a *app.App, gw *proxy.Gateway) *gin.Engine {
 			auth.GET("/me", middleware.SessionAuth(a), h.Me)
 		}
 
+		webauthn := api.Group("/webauthn")
+		{
+			webauthn.POST("/register/begin", middleware.SessionAuth(a), h.PasskeyRegisterBegin)
+			webauthn.POST("/register/complete", middleware.SessionAuth(a), h.PasskeyRegisterComplete)
+			webauthn.POST("/login/begin", h.PasskeyLoginBegin)
+			webauthn.POST("/login/complete", h.PasskeyLoginComplete)
+			webauthn.GET("/passkeys", middleware.SessionAuth(a), h.PasskeyList)
+			webauthn.DELETE("/passkeys/:id", middleware.SessionAuth(a), h.PasskeyDelete)
+		}
+
 		user := api.Group("", middleware.SessionAuth(a))
 		{
 			user.GET("/user/profile", h.UserProfile)