Passkey: 账户设置绑定 + 免密登录(WebAuthn)

- 引入 go-webauthn, Passkey 表存凭据, challenge 会话内存存储(带过期)
- API: /webauthn/register|login begin/complete, /webauthn/passkeys 列表/删除
- 配置 OT_WEBAUTHN_RP_ID/RP_ORIGIN/RP_NAME;登录成功发 JWT+refresh cookie
- 前端 lib/webauthn(编解码+凭据序列化+安全上下文检测), 账户设置绑定区, 登录页免密按钮
- 需 HTTPS 或 localhost(安全上下文)

Co-Authored-By: Claude <noreply@anthropic.com>

web/src/stores/auth.ts

@@ -29,7 +29,9 @@ export const useAuthStore = defineStore('auth', {
     },
     async login(username: string, password: string) {
       const { data } = await http.post('/auth/login', { username, password })
-      const d = data.data as { access_token: string; user: User }
+      this.setSession(data.data)
+    },
+    setSession(d: { access_token: string; user: User }) {
       this.accessToken = d.access_token
       this.user = d.user
       localStorage.setItem('ot_access', d.access_token)