Passkey: 账户设置绑定 + 免密登录(WebAuthn)

- 引入 go-webauthn, Passkey 表存凭据, challenge 会话内存存储(带过期)
- API: /webauthn/register|login begin/complete, /webauthn/passkeys 列表/删除
- 配置 OT_WEBAUTHN_RP_ID/RP_ORIGIN/RP_NAME;登录成功发 JWT+refresh cookie
- 前端 lib/webauthn(编解码+凭据序列化+安全上下文检测), 账户设置绑定区, 登录页免密按钮
- 需 HTTPS 或 localhost(安全上下文)

Co-Authored-By: Claude <noreply@anthropic.com>

server/internal/app/app.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/openteam/server/internal/channel"
 	"github.com/openteam/server/internal/config"
+	"github.com/openteam/server/internal/passkey"
 	"github.com/openteam/server/internal/pkg/crypto"
 	"github.com/openteam/server/internal/pkg/jwt"
 	"github.com/openteam/server/internal/pkg/ratelimit"
@@ -25,6 +26,7 @@ type App struct {
 	Usage     *usage.Recorder
 	Health    *channel.HealthMonitor
 	Limit     *ratelimit.Limiter
+	Passkeys  *passkey.Service
 	startedAt time.Time
 	ctx       context.Context
 	cancel    context.CancelFunc
@@ -57,6 +59,13 @@ func New(cfg *config.Config) (*App, error) {
 		FailThreshold: cfg.Proxy.HealthFailThreshold,
 	})
 	a.Health.Start(a.ctx)
+
+	a.Passkeys, err = passkey.New(db, passkey.Config{
+		RPID: cfg.WebAuthn.RPID, Origin: cfg.WebAuthn.RPOrigin, Name: cfg.WebAuthn.RPName,
+	})
+	if err != nil {
+		return nil, err
+	}
 	return a, nil
 }